CVE-2024-29156
Information leakage in YAQL
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
CVE-2024-29156- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
CVE List
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
CVE-2024-29156- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2024-0973
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
EUVD-2024-0973- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mvf6-hwxh-7v76
Information leakage in YAQL
YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
GHSA-mvf6-hwxh-7v76- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-116, CWE-200
- Updated
- 2026-11-02
OSV
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
CVE-2024-29156- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVDEBIAN-CVE-2024-29156
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
DEBIAN-CVE-2024-29156- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-mvf6-hwxh-7v76
Information leakage in YAQL
YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
GHSA-mvf6-hwxh-7v76- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-116, CWE-200
- Updated
- 2026-11-02
OSVOESA-2024-1328
python-yaql security update
YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.
Security Fix(es):
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)
- Record
OESA-2024-1328- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1329
python-yaql security update
YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.
Security Fix(es):
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)
- Record
OESA-2024-1329- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1330
python-yaql security update
YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.
Security Fix(es):
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)
- Record
OESA-2024-1330- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1331
python-yaql security update
YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.
Security Fix(es):
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)
- Record
OESA-2024-1331- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1332
python-yaql security update
YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.
Security Fix(es):
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)
- Record
OESA-2024-1332- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2026-2059
Information leakage in YAQL
YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
PYSEC-2026-2059- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2024:1930
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-tripleo-heat-templates and python-yaql) security update
- Record
RHSA-2024:1930- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:1931
Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-yaql and openstack-tripleo-heat-templates) security update
- Record
RHSA-2024:1931- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:4053
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security update
- Record
RHSA-2024:4053- CVSS 3.1
- 8.4 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-29156
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
- Record
UBUNTU-CVE-2024-29156- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
yaqlPyPI |
before 3.0.0 | 3.0.0 |
muranoDebian:12 |
All versions, plus listed versions 1:14.0.0-31:15.0.0-11:15.0.0-21:15.0.0-31:15.0.0-41:15.0.0~rc1-11:16.0.0-11:16.0.0~rc1-1 |
None known |
yaqlPyPI |
before 3.0.0, plus listed versions 0.20.2.10.2.20.2.30.2.4 Show 20 moreShow less0.2.50.2.60.2.70.31.0.01.0.0.0b31.0.0.0rc11.0.0.0rc21.0.0.0rc31.0.0b11.0.0b21.0.11.0.21.0.31.1.01.1.11.1.21.1.32.0.02.0.1 |
3.0.0 |
python-yaqlopenEuler:22.03-LTS |
before 1.1.3-2.oe2203 | 1.1.3-2.oe2203 |
python-yaqlopenEuler:22.03-LTS-SP1 |
before 2.0.0-2.oe2203sp1 | 2.0.0-2.oe2203sp1 |
python-yaqlopenEuler:22.03-LTS-SP2 |
before 2.0.0-2.oe2203sp2 | 2.0.0-2.oe2203sp2 |
python-yaqlopenEuler:22.03-LTS-SP3 |
before 2.0.0-2.oe2203sp3 | 2.0.0-2.oe2203sp3 |
python-yaqlopenEuler:20.03-LTS-SP4 |
before 1.1.3-2.oe2003sp4 | 1.1.3-2.oe2003sp4 |
openstack-tripleo-heat-templatesRed Hat:openstack:17.1::el8 |
before 0:14.3.1-17.1.20231103003748.2.el8ost | 0:14.3.1-17.1.20231103003748.2.el8ost |
python-yaqlRed Hat:openstack:17.1::el8 |
before 0:1.1.3-11.el8ost | 0:1.1.3-11.el8ost |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3-yaqlRed Hat:openstack:17.1::el8 |
before 0:1.1.3-11.el8ost | 0:1.1.3-11.el8ost |
openstack-tripleo-heat-templatesRed Hat:openstack:17.1::el9 |
before 0:14.3.1-17.1.20231103010826.2.el9ost | 0:14.3.1-17.1.20231103010826.2.el9ost |
python-yaqlRed Hat:openstack:17.1::el9 |
before 0:1.1.3-11.el9ost | 0:1.1.3-11.el9ost |
python3-yaqlRed Hat:openstack:17.1::el9 |
before 0:1.1.3-11.el9ost | 0:1.1.3-11.el9ost |
openstack-tripleo-commonRed Hat:openstack:16.2::el8 |
before 0:11.7.1-2.20230809225405.e189622.el8ost | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-container-baseRed Hat:openstack:16.2::el8 |
before 0:11.7.1-2.20230809225405.e189622.el8ost | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-containersRed Hat:openstack:16.2::el8 |
before 0:11.7.1-2.20230809225405.e189622.el8ost | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-common-devtoolsRed Hat:openstack:16.2::el8 |
before 0:11.7.1-2.20230809225405.e189622.el8ost | 0:11.7.1-2.20230809225405.e189622.el8ost |
openstack-tripleo-heat-templatesRed Hat:openstack:16.2::el8 |
before 0:11.6.1-2.20230808225220.el8ost | 0:11.6.1-2.20230808225220.el8ost |
python-yaqlRed Hat:openstack:16.2::el8 |
before 0:1.1.3-9.el8ost | 0:1.1.3-9.el8ost |
python3-tripleo-commonRed Hat:openstack:16.2::el8 |
before 0:11.7.1-2.20230809225405.e189622.el8ost | 0:11.7.1-2.20230809225405.e189622.el8ost |
python3-yaqlRed Hat:openstack:16.2::el8 |
before 0:1.1.3-9.el8ost | 0:1.1.3-9.el8ost |
muranoUbuntu:16.04:LTS |
All versions, plus listed versions 1:1.0.0~rc1-1ubuntu11:1.0.1-21:2.0.0~b3-11:2.0.0~b3-21:2.0.0~rc1-11:2.0.0~rc3-11:2.0.0-1 |
None known |
muranoUbuntu:18.04:LTS |
All versions, plus listed versions 1:4.0.0-0ubuntu11:4.0.0-0ubuntu21:5.0.0~b1-0ubuntu11:5.0.0~b2-0ubuntu11:5.0.0~b3-0ubuntu11:5.0.0~rc1-0ubuntu11:5.0.0-0ubuntu1 |
None known |
muranoUbuntu:20.04:LTS |
All versions, plus listed versions 1:8.0.0-0ubuntu11:9.0.0~b1~git2019121815.3afc74b1-0ubuntu11:9.0.0~b1~git2019121815.3afc74b1-0ubuntu21:9.0.0~b2~git2020020609.25ebd01d-0ubuntu11:9.0.0~b2~git2020020609.25ebd01d-0ubuntu21:9.0.0~b3~git2020041013.564f9cf3-0ubuntu11:9.0.0-0ubuntu0.20.04.1 |
None known |
muranoUbuntu:22.04:LTS |
All versions, plus listed versions 1:12.0.0-0ubuntu11:12.0.0+git2021120910.314c85db-0ubuntu11:12.0.0+git2022030313.f0258fc8-0ubuntu11:13.0.0-0ubuntu1 |
None known |
muranoUbuntu:24.04:LTS |
All versions, plus listed versions 1:16.0.0-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29156 is a medium vulnerability (CVSS 6.5) in Openstack Murano, published March 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in yaql 3.0.0.
References
wiki.openstack.org/wiki/OSSN/OSSN-0093
launchpad.net/bugs/2048114
opendev.org/openstack/murano/tags
nvd.nist.gov/vuln/detail/CVE-2024-29156
bugs.launchpad.net/murano/+bug/2048114
Show 20 moreShow less
github.com/advisories/GHSA-mvf6-hwxh-7v76
security-tracker.debian.org/tracker/CVE-2024-29156
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1328
pypi.org/project/yaql
access.redhat.com/errata/RHSA-2024:1930
bugzilla.redhat.com/show_bug.cgi?id=2269112
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1930.json
cve.org/CVERecord?id=CVE-2024-29156
ubuntu.com/security/CVE-2024-29156