UBUNTU-CVE-2024-29156
- Source
- https://ubuntu.com/security/CVE-2024-29156
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-29156.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-29156
- Upstream
- Published
- 2024-03-18T07:15:00Z
- Modified
- 2025-07-14T06:46:41.125724Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- - medium
- Summary
- [none]
- Details
-
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- References
-
- https://ubuntu.com/security/CVE-2024-29156
- https://bugs.launchpad.net/murano/+bug/2048114
- https://wiki.openstack.org/wiki/OSSN/OSSN-0093
- https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
- https://launchpad.net/bugs/2048114
- https://opendev.org/openstack/murano/tags
- https://www.cve.org/CVERecord?id=CVE-2024-29156
Affected packages
Ubuntu:Pro:16.04:LTS / murano
Package
- Name
- murano
- Purl
- pkg:deb/ubuntu/murano@1:2.0.0-1?arch=source&distro=esm-apps/xenial
Ubuntu:Pro:18.04:LTS / murano
Package
- Name
- murano
- Purl
- pkg:deb/ubuntu/murano@1:5.0.0-0ubuntu1?arch=source&distro=esm-apps/bionic
Ubuntu:Pro:20.04:LTS / murano
Package
- Name
- murano
- Purl
- pkg:deb/ubuntu/murano@1:9.0.0-0ubuntu0.20.04.1?arch=source&distro=esm-apps/focal
Ubuntu:22.04:LTS / murano
Package
- Name
- murano
- Purl
- pkg:deb/ubuntu/murano@1:13.0.0-0ubuntu1?arch=source&distro=jammy