OpenStack Security Advisory

  1. Bug #1586136
  2. Comment #7

Comment 7 for bug 1586136

Revision history for this message
Kirill Zaitsev (kzaitsev) wrote :

Title: RCE vulnerability in Openstack Murano using insecure YAML tags
Reporter: Kirill Zaitsev
Product: murano
Affects: <=2015.1.1; <=1.0.2; ==2.0.0
Product: murano-dashboard
Affects: <=2015.1.1; <=1.0.2; ==2.0.0
Product: python-muranoclient
Affects: <=0.7.2; >=0.8.0<=0.8.4

Description:
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack Murano applications processing. Using extended YAML tags in Murano application YAML files, an attacker can perform a Remote Code Execution attack.