[murano] YaqlYamlLoader inherits from YamlLoader

[Kirill Zaitsev]

YaqlYamlLoader inherits from YamlLoader, meaning that it is possible to use extended unsafe tags in yaml files http://pyyaml.org/wiki/PyYAMLDocumentation#YAMLtagsandPythontypes

dashboard, engine/api, and client are vulnerable.

CVE Description:
Kirill Zaitsev from Mirantis reported a vulnerability in OpenStack Murano applications processing. Using extended YAML tags in Murano application YAML files, an attacker can perform a Remote Code Execution attack.

[Vitaly Sedelnik (vsedelnik)]

Setting to In Progress for 6.1-updates, 7.0-updates, 8.0-updates, the link to reviews is https://review.fuel-infra.org/#/q/topic:bug/1593002

[Dina Belova (dbelova)]

This is a really simple security vulnerability with remote code execution against the cloud controller node. I agree this can be treated as a critical issue. Let's fix it asap.

[Adam Heczko (aheczko-mirantis)]

Agree, please merge fix before MOS 9.0 GA release.

[Dina Belova (dbelova)]

ETA: today, patches are +2/+2/A, should be merged in hours.

[Victor Ryzhenkin (vryzhenkin)]

Fix for 9.0 included since 494 mos iso build.

[TatyanaGladysheva (tgladysheva)]

Fix for 7.0 is included in MU5 updates.

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: mcp/newton
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/33574

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: mcp/newton
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/33707

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 11.0/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34028

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 11.0/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34033

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: 11.0/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34051

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: mcp/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34655

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: mcp/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34752

[Fuel Devops McRobotson (fuel-devops-robot)]

Fix proposed to branch: mcp/ocata
Change author: Kirill Zaitsev <email address hidden>
Review: https://review.fuel-infra.org/34764

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: 11.0/ocata
Review: https://review.fuel-infra.org/34051
Reason: 11.0/ocata is obsolete. We use mcp/ocata instead.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Roman Podoliaka <email address hidden> on branch: 11.0/ocata
Review: https://review.fuel-infra.org/34028
Reason: we do not need 11.0/ocata anymore - use mcp/ocata instead

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Roman Podoliaka <email address hidden> on branch: 11.0/ocata
Review: https://review.fuel-infra.org/34033
Reason: we do not need 11.0/ocata anymore - use mcp/ocata instead

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/ocata
Review: https://review.fuel-infra.org/34752
Reason: The patch has been upstreamed and exists in mcp/ocata.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/ocata
Review: https://review.fuel-infra.org/34764
Reason: The patch has been upstreamed and is not required for mcp/ocata.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/ocata
Review: https://review.fuel-infra.org/34655
Reason: The patch has been upstreamed and is not required in mcp/ocata.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/newton
Review: https://review.fuel-infra.org/33574
Reason: The patch has been upstreamed and is not required for mcp/newton.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/newton
Review: https://review.fuel-infra.org/33487
Reason: The patch has been upstreamed and is not required for mcp/newton.

[Fuel Devops McRobotson (fuel-devops-robot)]

Change abandoned by Ihor Kalnytskyi <email address hidden> on branch: mcp/newton
Review: https://review.fuel-infra.org/33707
Reason: The patch has been upstreamed and is not required for mcp/newton.