{"id":"CVE-2024-29156","aliases":["DEBIAN-CVE-2024-29156","EUVD-2024-0973","GHSA-mvf6-hwxh-7v76","OESA-2024-1328","OESA-2024-1329","OESA-2024-1330","OESA-2024-1331","OESA-2024-1332","PYSEC-2026-2059","RHSA-2024:1930","RHSA-2024:1931","RHSA-2024:4053","UBUNTU-CVE-2024-29156"],"status":"published","title":"Information leakage in YAQL","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00746,"percentile":0.55148,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-200"],"published":"2024-03-18T00:00:00Z","modified":"2026-11-02T12:02:30Z","fixes":[{"ecosystem":"PyPI","package":"yaql","fixed_in":["3.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"python-yaql","fixed_in":["1.1.3-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"python-yaql","fixed_in":["2.0.0-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"python-yaql","fixed_in":["2.0.0-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-yaql","fixed_in":["2.0.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-yaql","fixed_in":["1.1.3-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-heat-templates","fixed_in":["0:14.3.1-17.1.20231103003748.2.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python-yaql","fixed_in":["0:1.1.3-11.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-yaql","fixed_in":["0:1.1.3-11.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-heat-templates","fixed_in":["0:14.3.1-17.1.20231103010826.2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python-yaql","fixed_in":["0:1.1.3-11.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-yaql","fixed_in":["0:1.1.3-11.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common","fixed_in":["0:11.7.1-2.20230809225405.e189622.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-container-base","fixed_in":["0:11.7.1-2.20230809225405.e189622.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-containers","fixed_in":["0:11.7.1-2.20230809225405.e189622.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-devtools","fixed_in":["0:11.7.1-2.20230809225405.e189622.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-heat-templates","fixed_in":["0:11.6.1-2.20230808225220.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python-yaql","fixed_in":["0:1.1.3-9.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-tripleo-common","fixed_in":["0:11.7.1-2.20230809225405.e189622.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-yaql","fixed_in":["0:1.1.3-9.el8ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:14.0.0-3","1:15.0.0-1","1:15.0.0-2","1:15.0.0-3","1:15.0.0-4","1:15.0.0~rc1-1","1:16.0.0-1","1:16.0.0~rc1-1"]},{"source":"osv","ecosystem":"PyPI","package":"yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"versions":["0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.3","1.0.0","1.0.0.0b3","1.0.0.0rc1","1.0.0.0rc2","1.0.0.0rc3","1.0.0b1","1.0.0b2","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","2.0.0","2.0.1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.3-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0"}]}],"versions":["0.2","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.3","1.0.0","1.0.0.0b3","1.0.0.0rc1","1.0.0.0rc2","1.0.0.0rc3","1.0.0b1","1.0.0b2","1.0.1","1.0.2","1.0.3","1.1.0","1.1.1","1.1.2","1.1.3","2.0.0","2.0.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"openstack-tripleo-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.3.1-17.1.20231103003748.2.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-11.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el8","package":"python3-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-11.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"openstack-tripleo-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:14.3.1-17.1.20231103010826.2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-11.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"python3-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-11.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.20230809225405.e189622.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-container-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.20230809225405.e189622.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.20230809225405.e189622.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-common-devtools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.20230809225405.e189622.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-tripleo-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.6.1-2.20230808225220.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-9.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-tripleo-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.7.1-2.20230809225405.e189622.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-yaql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.3-9.el8ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.0.0~rc1-1ubuntu1","1:1.0.1-2","1:2.0.0~b3-1","1:2.0.0~b3-2","1:2.0.0~rc1-1","1:2.0.0~rc3-1","1:2.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.0.0-0ubuntu1","1:4.0.0-0ubuntu2","1:5.0.0~b1-0ubuntu1","1:5.0.0~b2-0ubuntu1","1:5.0.0~b3-0ubuntu1","1:5.0.0~rc1-0ubuntu1","1:5.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:8.0.0-0ubuntu1","1:9.0.0~b1~git2019121815.3afc74b1-0ubuntu1","1:9.0.0~b1~git2019121815.3afc74b1-0ubuntu2","1:9.0.0~b2~git2020020609.25ebd01d-0ubuntu1","1:9.0.0~b2~git2020020609.25ebd01d-0ubuntu2","1:9.0.0~b3~git2020041013.564f9cf3-0ubuntu1","1:9.0.0-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:12.0.0-0ubuntu1","1:12.0.0+git2021120910.314c85db-0ubuntu1","1:12.0.0+git2022030313.f0258fc8-0ubuntu1","1:13.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"murano","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:16.0.0-0ubuntu1"]}],"products":[{"vendor":"openstack","product":"murano"},{"vendor":"openstack","product":"yaql"}],"references":[{"url":"https://wiki.openstack.org/wiki/OSSN/OSSN-0093","tags":["x_transferred","Product","web","report"]},{"url":"https://launchpad.net/bugs/2048114","tags":["x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://opendev.org/openstack/murano/tags","tags":["x_transferred","Issue Tracking","web","report"]},{"url":"https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3","tags":["x_transferred","Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29156","tags":["advisory"]},{"url":"https://bugs.launchpad.net/murano/+bug/2048114","tags":["web","article","report"]},{"url":"https://github.com/advisories/GHSA-mvf6-hwxh-7v76","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29156.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-29156","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1328","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1329","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1330","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1331","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1332","tags":["advisory"]},{"url":"https://pypi.org/project/yaql","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1930","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269112","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1930.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-29156","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-29156","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1931","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1931.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4053","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4053.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-29156","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-29156","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2025-03-25T20:07:53.472Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-0973","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2025-03-25T20:07:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:52.192094Z"}],"ghsa":[{"id":"GHSA-mvf6-hwxh-7v76","title":"Information leakage in YAQL","description":"YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T09:30:30Z","modified":"2025-03-26T00:44:00Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-116","CWE-200"],"updated_at":"2026-11-02T14:38:36.51789Z"}],"nvd":[{"id":"CVE-2024-29156","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T07:15:05.88Z","modified":"2026-06-17T07:22:31.07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:09:41.654534Z"}],"osv":[{"id":"CVE-2024-29156","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T00:00:00Z","modified":"2026-11-03T02:30:54.167640812Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:05:53.289262Z"},{"id":"DEBIAN-CVE-2024-29156","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T07:15:05.88Z","modified":"2026-11-02T12:02:30.459024617Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-mvf6-hwxh-7v76","title":"Information leakage in YAQL","description":"YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T09:30:30Z","modified":"2026-07-07T17:56:41.779146063Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-116","CWE-200"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2024-1328","title":"python-yaql security update","description":"YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.\r\n\r\nSecurity Fix(es):\r\n\r\nIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service\u0026apos;s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)","status":"published","published":"2024-03-29T11:06:46Z","modified":"2026-08-18T01:18:20.008592246Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1329","title":"python-yaql security update","description":"YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.\r\n\r\nSecurity Fix(es):\r\n\r\nIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service\u0026apos;s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)","status":"published","published":"2024-03-29T11:06:46Z","modified":"2026-08-18T01:18:20.108564868Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1330","title":"python-yaql security update","description":"YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.\r\n\r\nSecurity Fix(es):\r\n\r\nIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service\u0026apos;s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)","status":"published","published":"2024-03-29T11:06:46Z","modified":"2026-08-18T01:17:12.731379947Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1331","title":"python-yaql security update","description":"YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.\r\n\r\nSecurity Fix(es):\r\n\r\nIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service\u0026apos;s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)","status":"published","published":"2024-03-29T11:06:46Z","modified":"2026-08-18T01:17:13.030555195Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1332","title":"python-yaql security update","description":"YAQL (Yet Another Query Language) is an embeddable and extensible query language, that allows performing complex queries against arbitrary objects. It has a vast and comprehensive standard library of frequently used querying functions and can be extend even further with user-specified functions. YAQL is written in python and is distributed via PyPI.\r\n\r\nSecurity Fix(es):\r\n\r\nIn OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service\u0026apos;s MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.(CVE-2024-29156)","status":"published","published":"2024-03-29T11:06:46Z","modified":"2026-08-18T01:18:20.102040642Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"PYSEC-2026-2059","title":"Information leakage in YAQL","description":"YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2026-07-07T11:45:35.519704Z","modified":"2026-07-07T17:48:18.058201333Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"RHSA-2024:1930","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-tripleo-heat-templates and python-yaql) security update","status":"published","published":"2024-09-16T18:44:03Z","modified":"2026-08-04T10:09:08Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:1931","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-yaql and openstack-tripleo-heat-templates) security update","status":"published","published":"2024-09-16T18:43:55Z","modified":"2026-08-04T10:09:08Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4053","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security update","status":"published","published":"2024-09-16T18:44:11Z","modified":"2026-08-04T10:09:45Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-29156","description":"In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.","status":"published","published":"2024-03-18T07:15:00Z","modified":"2025-10-24T05:09:09Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"}]}}