medium6.5
CVE-2024-29156
Information leakage in YAQL
Impact
YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | yaql | < 3.0.0 | 3.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Openstack | Murano | through 16.0.0 |
| Openstack | Yaql | before 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://launchpad.net/bugs/2048114
- https://opendev.org/openstack/murano/tags
- https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
- https://wiki.openstack.org/wiki/OSSN/OSSN-0093
- https://github.com/advisories/GHSA-mvf6-hwxh-7v76
- https://nvd.nist.gov/vuln/detail/CVE-2024-29156
- https://bugs.launchpad.net/murano/+bug/2048114