Information leakage in YAQL

中危 6.5CVE-2024-29156 · GHSA-mvf6-hwxh-7v76 · PYSEC-2026-2059 · Published 18/03/2024 · updated 17/06/2026

要点

CVE-2024-29156 是影响 yaql, murano (openstack), yaql (openstack) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.75%，高于 54.8% 的漏洞。
修复：升级到 3.0.0 或更高版本。

Package	Affected versions	Patched versions
yaql PyPI	`< 3.0.0`	`3.0.0`
murano openstack	`≤ 16.0.0`	No fix yet
yaql openstack	`< 3.0.0`	`3.0.0`

Description

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

NVD description

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

References

nvd.nist.gov/vuln/detail/CVE-2024-29156 · ADVISORY
bugs.launchpad.net/murano/+bug/2048114 · WEB
launchpad.net/bugs/2048114 · WEB
opendev.org/openstack/murano/tags · WEB
opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3 · WEB
wiki.openstack.org/wiki/OSSN/OSSN-0093 · WEB
pypi.org/project/yaql · PACKAGE
GitHub Advisory GHSA-mvf6-hwxh-7v76 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free