What’s Vulnerable › Vulnerabilities

CVE-2016-4972

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2016-09-26 · updated 2026-06-17
• Weakness: CWE-20

Description

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

Affected products

• OpenStack Mitaka-Murano: through 2.0.0
• OpenStack Murano: through 1.0.2
• OpenStack Murano-Dashboard: through 1.0.2
• OpenStack Python-Muranoclient: through 0.7.2

References

• http://www.openwall.com/lists/oss-security/2016/06/23/8
• https://bugs.launchpad.net/murano/+bug/1586079
• https://bugs.launchpad.net/python-muranoclient/+bug/1586078
• http://www.openwall.com/lists/oss-security/2016/06/23/8
• https://bugs.launchpad.net/murano/+bug/1586079
• https://bugs.launchpad.net/python-muranoclient/+bug/1586078

Get alerted when CVE-2016-4972 or the next vulnerability affects your stack