CVE-2016-4972

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/06/23/8Patch, Third Party Advisory
https://bugs.launchpad.net/murano/+bug/1586079Patch, Vendor Advisory
https://bugs.launchpad.net/python-muranoclient/+bug/1586078Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/06/23/8Patch, Third Party Advisory
https://bugs.launchpad.net/murano/+bug/1586079Patch, Vendor Advisory
https://bugs.launchpad.net/python-muranoclient/+bug/1586078Patch, Vendor Advisory

Timeline

Published: Sep 26, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-49737.8Binaries compiled against targets that use the libssp library in GCC for stack smashing protection (SSP) might allow local users to perform CVE-2016-49747.5Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpat CVE-2016-49756.1Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made i CVE-2016-49765.5Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive CVE-2016-49778.8When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_t CVE-2016-49787.2The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in CVE-2016-49797.5The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient requi CVE-2016-49802.5A password generation weakness exists in xquest through 2016-06-13.CVE-2016-49824.7authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creati CVE-2016-49833.3A postinstall script in the dovecot rpm allows local users to read the contents of newly created SSL/TLS key files.CVE-2016-49844.7/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to CVE-2016-49857.5The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive