CVE-2016-4972

CRITICAL9.8EPSS 3.9%

OpenStack Murano Code Execution

發布日:2022/5/17修改日:2026/4/28

描述

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

受影響套件(7)

Debian/muranofrom 0, < 1:2.0.1-1
Debian/murano-dashboardfrom 0, < 1:2.0.0-5
Debian/python-muranoclientfrom 0, < 0.8.3-4
PyPI/muranofrom 0, < 1.0.3
PyPI/murano-dashboardfrom 0, < 1.0.3
PyPI/python-muranoclientfrom 0, < 0.7.3, >= 0.8, < 0.8.5
PyPI/python-muranoclientfrom 0, < 0.7.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

描述

受影響套件(7)

CVSS 分數

參考連結(10)