GHSA-87r7-q54j-f9qg

Suggest an improvement
Source
https://github.com/advisories/GHSA-87r7-q54j-f9qg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-87r7-q54j-f9qg
Aliases
Published
2022-05-17T03:48:22Z
Modified
2026-06-29T12:26:46Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenStack Murano Code Execution
Details

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.

Database specific 
{
    "cwe_ids":  [
        "CWE-20"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-31T23:11:19Z",
    "nvd_published_at":  "2016-09-26T16:59:00Z",
    "severity":  "CRITICAL"
}
References

Affected packages

PyPI / murano

Package

Name
murano
View open source insights on deps.dev
Purl
pkg:pypi/murano

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.3

Affected versions

Other
0
1.*
1.0.0.0b1
1.0.0.0b2
1.0.0.0b3
1.0.0.0rc1
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json"

PyPI / murano-dashboard

Package

Name
murano-dashboard
View open source insights on deps.dev
Purl
pkg:pypi/murano-dashboard

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.3

Affected versions

Other
0
1.*
1.0.0.0b1
1.0.0.0b2
1.0.0.0b3
1.0.0.0rc1
1.0.0
1.0.1
1.0.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json"

PyPI / murano-dashboard

Package

Name
murano-dashboard
View open source insights on deps.dev
Purl
pkg:pypi/murano-dashboard

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.0.1

Affected versions

2.*
2.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json"

PyPI / python-muranoclient

Package

Name
python-muranoclient
View open source insights on deps.dev
Purl
pkg:pypi/python-muranoclient

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.7.3

Affected versions

0.*
0.2
0.2.11
0.2.12
0.3
0.4
0.4.1
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.5.8
0.5.9
0.6.0
0.6.2
0.6.3
0.7.0
0.7.1
0.7.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json"

PyPI / python-muranoclient

Package

Name
python-muranoclient
View open source insights on deps.dev
Purl
pkg:pypi/python-muranoclient

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.8.0
Fixed
0.8.5

Affected versions

0.*
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87r7-q54j-f9qg/GHSA-87r7-q54j-f9qg.json"