In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
References
| Link | Resource |
|---|---|
| https://launchpad.net/bugs/2048114 | Issue Tracking Third Party Advisory |
| https://launchpad.net/bugs/2048114 | Issue Tracking Third Party Advisory |
| https://opendev.org/openstack/murano/tags | Issue Tracking |
| https://opendev.org/openstack/murano/tags | Issue Tracking |
| https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 | Patch |
| https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 | Patch |
| https://wiki.openstack.org/wiki/OSSN/OSSN-0093 | Product |
| https://wiki.openstack.org/wiki/OSSN/OSSN-0093 | Product |
Configurations
Configuration 1 (hide)
|
History
25 Mar 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://launchpad.net/bugs/2048114 - Issue Tracking, Third Party Advisory |
27 Feb 2025, 03:34
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wiki.openstack.org/wiki/OSSN/OSSN-0093 - Product | |
| References | () https://launchpad.net/bugs/2048114 - Issue Tracking | |
| References | () https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 - Patch | |
| References | () https://opendev.org/openstack/murano/tags - Issue Tracking | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| CWE | NVD-CWE-noinfo | |
| First Time |
Openstack
Openstack yaql Openstack murano |
|
| CPE | cpe:2.3:a:openstack:yaql:*:*:*:*:*:*:*:* cpe:2.3:a:openstack:murano:*:*:*:*:*:*:*:* |
18 Mar 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-03-18 07:15
Updated : 2025-03-25 20:15
NVD link : CVE-2024-29156
Mitre link : CVE-2024-29156
JSON object : View
Products Affected
openstack
- murano
- yaql
CWE