UBUNTU-CVE-2016-4972

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2016-4972
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2016/UBUNTU-CVE-2016-4972.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2016-4972
Related
Published
2016-09-26T16:59:00Z
Modified
2025-01-13T10:21:14Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

References

Affected packages

Ubuntu:Pro:16.04:LTS / murano

Package

Name
murano
Purl
pkg:deb/ubuntu/murano@1:2.0.0-1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.0.0~rc1-1ubuntu1
1:1.0.1-2

1:2.*

1:2.0.0~b3-1
1:2.0.0~b3-2
1:2.0.0~rc1-1
1:2.0.0~rc3-1
1:2.0.0-1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / murano-dashboard

Package

Name
murano-dashboard
Purl
pkg:deb/ubuntu/murano-dashboard@1:2.0.0-1ubuntu1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:1.*

1:1.0.0~rc1-1ubuntu1
1:1.0.1-1

1:2.*

1:2.0.0~b3-0ubuntu1
1:2.0.0~rc1-1
1:2.0.0-1
1:2.0.0-1ubuntu1

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / python-muranoclient

Package

Name
python-muranoclient
Purl
pkg:deb/ubuntu/python-muranoclient@0.8.3-3?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.7.0-1
0.7.1-2
0.7.1-3
0.8.2-0ubuntu1
0.8.3-2
0.8.3-3

Ecosystem specific 

{
    "ubuntu_priority": "medium"
}