CVE-2016-4972
CriticalSummary
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), as well as Murano-dashboard and python-muranoclient, improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files. This allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions.
Risk Assessment
An attacker can exploit this vulnerability to execute remote code, posing a serious threat to the integrity and security of the system. This may lead to unauthorized access to data and potential financial losses.
Recommendation
It is recommended to update OpenStack Murano, Murano-dashboard, and python-muranoclient to the latest versions to mitigate this vulnerability. Additionally, conducting a security audit of applications using these components is advisable.
Original NVD description (English source)
OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.