CVE-2016-4972:
OpenStack Murano Code Execution
9.8
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.87796%
CWE
Published
5/17/2022
Updated
10/25/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| murano | pip | < 1.0.3 | 1.0.3 |
| murano-dashboard | pip | < 1.0.3 | 1.0.3 |
| python-muranoclient | pip | < 0.7.3 | 0.7.3 |
| murano-dashboard | pip | >= 2.0.0, < 2.0.1 | 2.0.1 |
| python-muranoclient | pip | >= 0.8.0, < 0.8.5 | 0.8.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from using PyYAML's unsafe Loader and Constructor classes, which parse YAML with full object deserialization capabilities. The commit diff shows the fix replaced yaml.Loader with yaml.SafeLoader and yaml.constructor.Constructor with SafeConstructor. The original classes in yaql_yaml_loader.py directly inherited from these unsafe bases, making them the root cause. The YAML parsing in MuranoPL and UI files used these vulnerable loaders, allowing attackers to exploit extended YAML tags for code execution.