<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><pre style="font-size: 14px; word-wrap: break-word;"><pre style="word-wrap: break-word;"><span style="white-space: pre-wrap;">==============================================================
RCE vulnerability in Openstack Murano using insecure YAML tags
==============================================================
:Date: <a href="http://airmail.calendar/2016-06-23%2012:00:00%20GMT+3">June 23, 2016</a>
:CVE: CVE-2016-4972
Affects
~~~~~~~
- Murano: <=2015.1.1; <=1.0.2; ==2.0.0
- Murano-dashboard: <=2015.1.1; <=1.0.2; ==2.0.0
- Python-muranoclient: <=0.7.2; >=0.8.0<=0.8.4
Description
~~~~~~~~~~~
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack
Murano applications processing. Using extended YAML tags in Murano
application YAML files, an attacker can perform a Remote Code
Execution attack.
Vulnerability has been verified in all currently supported branches.
Further examination of code suggest, that it is also present in kilo and
juno versions of murano.
Patches
~~~~~~~
- <a href="https://review.openstack.org/#/c/333444/">https://review.openstack.org/#/c/333444/</a> (Liberty)
- <a href="https://review.openstack.org/#/c/333425/">https://review.openstack.org/#/c/333425/</a> (Liberty)
- <a href="https://review.openstack.org/#/c/333432/">https://review.openstack.org/#/c/333432/</a> (Liberty)
- <a href="https://review.openstack.org/#/c/333443/">https://review.openstack.org/#/c/333443/</a> (Mitaka)
- <a href="https://review.openstack.org/#/c/333424/">https://review.openstack.org/#/c/333424/</a> (Mitaka)
- <a href="https://review.openstack.org/#/c/333439/">https://review.openstack.org/#/c/333439/</a> (Mitaka)
- <a href="https://review.openstack.org/#/c/333423/">https://review.openstack.org/#/c/333423/</a> (Newton)
- <a href="https://review.openstack.org/#/c/333440/">https://review.openstack.org/#/c/333440/</a> (Newton)
- <a href="https://review.openstack.org/#/c/333428/">https://review.openstack.org/#/c/333428/</a> (Newton)
Credits
~~~~~~~
- Kirill Zaitsev from Mirantis (CVE-2016-4972)
References
~~~~~~~~~~
- <a href="https://bugs.launchpad.net/python-muranoclient/+bug/1586078">https://bugs.launchpad.net/python-muranoclient/+bug/1586078</a>
- <a href="https://bugs.launchpad.net/murano/+bug/1586079">https://bugs.launchpad.net/murano/+bug/1586079</a>
- <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972</a>
<br></span></pre><pre style="word-wrap: break-word;"><span style="white-space: pre-wrap;">Notes
~~~~~
- Fixes for this bug are going to be included in the upcoming releases
of murano 1.0.3(liberty), 2.0.1(mitaka), 3.0.0(newton) and
python-muranoclient 0.7.3(liberty), 0.8.5(mitaka), 0.9.0(newton)
--
Kirill Zaitsev
Murano Project Technical Lead</span></pre></pre></div></body></html>