CVE-2016-4972

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.19%

Published

Sep 26, 2016

Modified

May 6, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

Weaknesses (CWE)

CWE-20

Affected Products (4)

openstack · mitaka-muranovulnerable

openstack · muranovulnerable

openstack · murano-dashboardvulnerable

openstack · python-muranoclientvulnerable

References (6)

http://www.openwall.com/lists/oss-security/2016/06/23/8

PatchThird Party Advisory

https://bugs.launchpad.net/murano/+bug/1586079

PatchVendor Advisory