CVE-2016-4972
OpenStack Murano Code Execution
Also known as GHSA-87r7-q54j-f9qg, PYSEC-2016-22, PYSEC-2026-429, PYSEC-2026-430
Published 10 y ago · modified 4 mo ago · JSON
Summary
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
Exploit prediction (EPSS)
3.19% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| OSV | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | murano | <1.0.3 | 1.0.3 |
| pypi | murano-dashboard | <1.0.3 >=2.0.0, <2.0.1 | 1.0.3 2.0.1 |
| pypi | python-muranoclient | <0.7.3 >=0.8.0, <0.8.5 >=0.8, <0.8.5 | 0.7.3 0.8.5 |
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- bugs.launchpad.net /python-muranoclient/+bug/1586078 · x_refsource_CONFIRM, x_transferred
- openwall.com /lists/oss-security/2016/06/23/8 · mailing-list, x_refsource_MLIST, x_transferred
- bugs.launchpad.net /murano/+bug/1586079 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-4972 · advisory
- github.com /openstack/murano/commit/28de8c36c9dbe4aaf4d062e6fb6099afd437f49b · web
- github.com /openstack/murano · package
- github.com /openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/notes/safeloa · web
- github.com /openstack/murano/blob/c898a310afbc27f12190446ef75d8b0bd12115eb/releasenotes/source/locale · web
- github.com /pypa/advisory-database/tree/main/vulns/python-muranoclient/PYSEC-2016-22.yaml · web
- github.com /advisories/GHSA-87r7-q54j-f9qg · advisory
- pypi.org /project/murano · package
- pypi.org /project/murano-dashboard · package
Sources
- CVE List: CVE-2016-4972
- GitHub Advisory: GHSA-87r7-q54j-f9qg
- NVD: CVE-2016-4972
- OSV: PYSEC-2016-22
- OSV: PYSEC-2026-429
- OSV: PYSEC-2026-430
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.