PT-2016-6202 · Openstack · Murano-Dashboard+2

Serg Melikyan + 1 · Published 2016-09-26 · Updated 2022-05-17 · CVE-2016-4972

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Murano versions prior to 1.0.3 (liberty) and prior to 2.0.1 (mitaka) Murano-dashboard versions prior to 1.0.3 (liberty) and prior to 2.0.1 (mitaka) python-muranoclient versions prior to 0.7.3 (liberty) and prior to 0.8.5 (mitaka)

Description The issue allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages. This is due to the improper use of loaders inherited from yaml.Loader when parsing MuranoPL and UI files.

Recommendations For OpenStack Murano versions prior to 1.0.3 (liberty) and prior to 2.0.1 (mitaka), update to version 1.0.3 (liberty) or 2.0.1 (mitaka) to resolve the issue. For Murano-dashboard versions prior to 1.0.3 (liberty) and prior to 2.0.1 (mitaka), update to version 1.0.3 (liberty) or 2.0.1 (mitaka) to resolve the issue. For python-muranoclient versions prior to 0.7.3 (liberty) and prior to 0.8.5 (mitaka), update to version 0.7.3 (liberty) or 0.8.5 (mitaka) to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-4972

GHSA-87R7-Q54J-F9QG

PYSEC-2016-22

Affected Products

Murano-Dashboard

Openstack Murano

Python-Muranoclient

References · 18

• 🔥 https://github.com/openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/notes/safeloader-cve-2016-4972-19035a2a091ec30a.yaml · Exploit
• https://bugs.launchpad.net/murano/+bug/1586079 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4972 · Vendor Advisory
• https://bugs.launchpad.net/python-muranoclient/+bug/1586078 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4972 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-87r7-q54j-f9qg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4972 · Security Note
• http://openwall.com/lists/oss-security/2016/06/23/8 · Patch
• https://osv.dev/vulnerability/PYSEC-2016-22 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4972 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4972 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-4972 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4972 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/python-muranoclient/PYSEC-2016-22.yaml · Note
• https://github.com/openstack/murano · Note