id: PYSEC-2016-22
details: OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard
  before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before
  0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited
  from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers
  to create arbitrary Python objects and execute arbitrary code via crafted extended
  YAML tags in UI definitions in packages.
affected:
- package:
    name: python-muranoclient
    ecosystem: PyPI
    purl: pkg:pypi/python-muranoclient
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.7.3
    - introduced: "0.8"
    - fixed: 0.8.5
  versions:
  - "0.2"
  - 0.2.11
  - 0.2.12
  - "0.3"
  - "0.4"
  - 0.4.1
  - 0.5.0
  - 0.5.1
  - 0.5.2
  - 0.5.3
  - 0.5.4
  - 0.5.5
  - 0.5.6
  - 0.5.7
  - 0.5.8
  - 0.5.9
  - 0.6.0
  - 0.6.2
  - 0.6.3
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
references:
- type: WEB
  url: https://bugs.launchpad.net/murano/+bug/1586079
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/06/23/8
- type: WEB
  url: https://bugs.launchpad.net/python-muranoclient/+bug/1586078
- type: ADVISORY
  url: https://github.com/advisories/GHSA-87r7-q54j-f9qg
aliases:
- CVE-2016-4972
- GHSA-87r7-q54j-f9qg
modified: "2021-07-25T23:34:52.302342Z"
published: "2016-09-26T16:59:00Z"