GHSA-87r7-q54j-f9qg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-87r7-q54j-f9qg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-87r7-q54j-f9qg
- Aliases
- Published
- 2022-05-17T03:48:22Z
- Modified
- 2024-10-25T20:46:01.794935Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- OpenStack Murano Code Execution
- Details
-
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
- Database specific
{ "nvd_published_at": "2016-09-26T16:59:00Z", "cwe_ids": [ "CWE-20" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2023-07-31T23:11:19Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2016-4972
- https://github.com/openstack/murano/commit/28de8c36c9dbe4aaf4d062e6fb6099afd437f49b
- https://bugs.launchpad.net/murano/+bug/1586079
- https://bugs.launchpad.net/python-muranoclient/+bug/1586078
- https://github.com/openstack/murano
- https://github.com/openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/notes/safeloader-cve-2016-4972-19035a2a091ec30a.yaml
- https://github.com/openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po
- https://github.com/pypa/advisory-database/tree/main/vulns/python-muranoclient/PYSEC-2016-22.yaml
- http://www.openwall.com/lists/oss-security/2016/06/23/8
Affected packages
PyPI / murano
Package
- Name
- murano
- View open source insights on deps.dev
- Purl
- pkg:pypi/murano
PyPI / murano-dashboard
Package
- Name
- murano-dashboard
- View open source insights on deps.dev
- Purl
- pkg:pypi/murano-dashboard
PyPI / murano-dashboard
Package
- Name
- murano-dashboard
- View open source insights on deps.dev
- Purl
- pkg:pypi/murano-dashboard
PyPI / python-muranoclient
Package
- Name
- python-muranoclient
- View open source insights on deps.dev
- Purl
- pkg:pypi/python-muranoclient
PyPI / python-muranoclient
Package
- Name
- python-muranoclient
- View open source insights on deps.dev
- Purl
- pkg:pypi/python-muranoclient