CVE-2024-29156

2024-03-1807:15:05

Debian Security Bug Tracker

security-tracker.debian.org

openstack

murano

yaql

sensitive information

leakage

service account

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.8%

JSON

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service’s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

OSVersionArchitecturePackageVersionFilename
Debian12allmurano<= 1:14.0.0-3murano_1:14.0.0-3_all.deb
Debian11allmurano<= 1:10.0.0-1murano_1:10.0.0-1_all.deb