Security Advisory

CVE-2016-4972

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2016-09-26 16:00:00

Last updated 2024-08-06 00:46:40

Assigner redhat

CVSS score not scored

State PUBLISHED

Description

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

← Browse all CVEs View on cve.org ↗