[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] RCE vulnerability in Openstack Murano using insecure YAML tags (CVE-2016-4972)
From: Kirill Zaitsev <k.zaitsev () me ! com>
Date: 2016-06-23 17:42:13
Message-ID: etPan.576c1f7b.5aae323e.126b () me ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
==============================================================
RCE vulnerability in Openstack Murano using insecure YAML tags
==============================================================
:Date: June 23, 2016
:CVE: CVE-2016-4972
Affects
~~~~~~~
- Murano: <=2015.1.1; <=1.0.2; ==2.0.0
- Murano-dashboard: <=2015.1.1; <=1.0.2; ==2.0.0
- Python-muranoclient: <=0.7.2; >=0.8.0<=0.8.4
Description
~~~~~~~~~~~
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack
Murano applications processing. Using extended YAML tags in Murano
application YAML files, an attacker can perform a Remote Code
Execution attack.
Vulnerability has been verified in all currently supported branches.
Further examination of code suggest, that it is also present in kilo and
juno versions of murano.
Patches
~~~~~~~
- https://review.openstack.org/#/c/333444/ (Liberty)
- https://review.openstack.org/#/c/333425/ (Liberty)
- https://review.openstack.org/#/c/333432/ (Liberty)
- https://review.openstack.org/#/c/333443/ (Mitaka)
- https://review.openstack.org/#/c/333424/ (Mitaka)
- https://review.openstack.org/#/c/333439/ (Mitaka)
- https://review.openstack.org/#/c/333423/ (Newton)
- https://review.openstack.org/#/c/333440/ (Newton)
- https://review.openstack.org/#/c/333428/ (Newton)
Credits
~~~~~~~
- Kirill Zaitsev from Mirantis (CVE-2016-4972)
References
~~~~~~~~~~
- https://bugs.launchpad.net/python-muranoclient/+bug/1586078
- https://bugs.launchpad.net/murano/+bug/1586079
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972
Notes
~~~~~
- Fixes for this bug are going to be included in the upcoming releases
of murano 1.0.3(liberty), 2.0.1(mitaka), 3.0.0(newton) and
python-muranoclient 0.7.3(liberty), 0.8.5(mitaka), 0.9.0(newton)
--
Kirill Zaitsev
Murano Project Technical Lead
[Attachment #5 (text/html)]
<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body \
style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: \
after-white-space;"><div id="bloop_customfont" style="margin: 0px;"><pre style="word-wrap: \
break-word;"><span style="white-space: \
pre-wrap;">============================================================== RCE vulnerability in \
Openstack Murano using insecure YAML tags \
==============================================================
> Date: June 23, 2016
> CVE: CVE-2016-4972
Affects
~~~~~~~
- Murano: <=2015.1.1; <=1.0.2; ==2.0.0
- Murano-dashboard: <=2015.1.1; <=1.0.2; ==2.0.0
- Python-muranoclient: <=0.7.2; >=0.8.0<=0.8.4
Description
~~~~~~~~~~~
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack
Murano applications processing. Using extended YAML tags in Murano
application YAML files, an attacker can perform a Remote Code
Execution attack.
Vulnerability has been verified in all currently supported branches.
Further examination of code suggest, that it is also present in kilo and
juno versions of murano.
Patches
~~~~~~~
- https://review.openstack.org/#/c/333444/ (Liberty)
- https://review.openstack.org/#/c/333425/ (Liberty)
- https://review.openstack.org/#/c/333432/ (Liberty)
- https://review.openstack.org/#/c/333443/ (Mitaka)
- https://review.openstack.org/#/c/333424/ (Mitaka)
- https://review.openstack.org/#/c/333439/ (Mitaka)
- https://review.openstack.org/#/c/333423/ (Newton)
- https://review.openstack.org/#/c/333440/ (Newton)
- https://review.openstack.org/#/c/333428/ (Newton)
Credits
~~~~~~~
- Kirill Zaitsev from Mirantis (CVE-2016-4972)
References
~~~~~~~~~~
- https://bugs.launchpad.net/python-muranoclient/+bug/1586078
- https://bugs.launchpad.net/murano/+bug/1586079
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972
<br></span></pre><pre style="word-wrap: break-word;"><span style="white-space: pre-wrap;">Notes
~~~~~
- Fixes for this bug are going to be included in the upcoming releases
of murano 1.0.3(liberty), 2.0.1(mitaka), 3.0.0(newton) and
python-muranoclient 0.7.3(liberty), 0.8.5(mitaka), 0.9.0(newton)
--
Kirill Zaitsev
Murano Project Technical Lead</span></pre></div></body></html>
--576c1f7b_7e5a9b40_126b--
["signature.asc" (signature.asc)]
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQIcBAEBCAAGBQJXbB+GAAoJEHrozOPeCWIUlHMQAJd3VUTdFMCXGtebzkvZdx0p
Fel/Wsdz+umjsHLFzVmYFa/91hVVTqwYlAY/yBe9PFNiLDnkC3muIJ6hn6wHU9TN
OFBWSnt88tuA09mySdxiNWSTDpasLnOGi5XmTmfFBRVNB1yOYPunJsKV4okgt44Q
Ts2IrDQEdWry7/2TzqyDWuoZSeKdPhjvn8KRqseXxlazRHd2rM6011LBzyTxs9vY
LQ0cxwrzm+40unjXmyux3SPWSqQAKyTLmB44gSTWq/lPmNkInth627fXSSHK8oE7
teC+NGTXJqB5R4s5dWlTLQwLrS5Rhpfw5BKBFJak47bMRXXcdc5+1H9UgxtBudS4
b++xDB2HuinQNuPBdbKMZVhGXnHtokwkuagcqCQ3UJpwbrczXyaHCULxoWDJ/WWm
hocJ7BuL5R0Fi6dditZIWpMWbpUik+9AJJlJNDMS4wbh+wMWRaluI/s26A5CKZF6
Qd7uumlZ9g8XlkX3M+X5sIcMsEuGaoTf9JJPrcWy6KZZPbIZGleqe4hkhB6LV87T
3/HS/42Wi211YtM6oR7Yt9rPmrRD4lEgy51gdmW8ENHaWglAPNWp1Em6q+y1B9S6
pC/zre23J350pteEstUK8X77BRXP6WIPp4FaRRrKxj0e19s+AMY/QvxdfQY9G5rS
EFMTcGmkNlu8Jz1bggCc
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic