CVE-2024-29156 Information leakage in YAQL
Attackers can leak sensitive service account information due to insufficient sanitization in the YAQL language extension used by OpenStack Murano.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29156?
CVE-2024-29156 is a medium-severity vulnerability in n/a, published on 18 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Weakness: CWE-116
Which versions are affected by CVE-2024-29156?
3 open source packages ship an affected version, including yaql. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
yaql PyPI | All versions | 3.0.0 |
yaql PyPI | All versions | 3.0.0 |
yaql PyPI | All versions | 3.0.0 |
Linux distribution packages (14)
openstack-tripleo-common Red Hat:openstack:16.2::el8 | All versions | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-container-base Red Hat:openstack:16.2::el8 | All versions | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-containers Red Hat:openstack:16.2::el8 | All versions | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-devtools Red Hat:openstack:16.2::el8 | All versions | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-heat-templates Red Hat:openstack:16.2::el8 | All versions | 0:11.6.1-2.20230808225220.el8ost |
python-yaql Red Hat:openstack:16.2::el8 | All versions | 0:1.1.3-9.el8ost |
python3-tripleo-common Red Hat:openstack:16.2::el8 | All versions | 0:11.7.1-2.20230809225405.e189622.el8ost |
python3-yaql Red Hat:openstack:16.2::el8 | All versions | 0:1.1.3-9.el8ost |
openstack-tripleo-heat-templates Red Hat:openstack:17.1::el8 | All versions | 0:14.3.1-17.1.20231103003748.2.el8ost |
python-yaql Red Hat:openstack:17.1::el8 | All versions | 0:1.1.3-11.el8ost |
python3-yaql Red Hat:openstack:17.1::el8 | All versions | 0:1.1.3-11.el8ost |
openstack-tripleo-heat-templates Red Hat:openstack:17.1::el9 | All versions | 0:14.3.1-17.1.20231103010826.2.el9ost |
python-yaql Red Hat:openstack:17.1::el9 | All versions | 0:1.1.3-11.el9ost |
python3-yaql Red Hat:openstack:17.1::el9 | All versions | 0:1.1.3-11.el9ost |
Products include Openstack Murano, Openstack Yaql.
How do I fix CVE-2024-29156?
Upgrade yaql to 3.0.0 or later.
Is CVE-2024-29156 being exploited?
There is no known exploitation of CVE-2024-29156 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-29156, GHSA-mvf6-hwxh-7v76, OESA-2024-1328, OESA-2024-1329, OESA-2024-1330, OESA-2024-1331 and 6 more.