CVE catalog
CVE-2024-29156
murano: CVE-2024-29156
- Severity
- High · CVSS 8.4
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.75% · Oct 25, 2026
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | murano | bookworm | 1:14.0.0-3 | vulnerable |
| Ubuntu | murano | 16.04 | 1:1.0.0~rc1-1ubuntu1 | vulnerable |
| Ubuntu | murano | 16.04 | 1:1.0.1-2 | vulnerable |
| Ubuntu | murano | 16.04 | 1:2.0.0~b3-1 | vulnerable |
| Ubuntu | murano | 16.04 | 1:2.0.0~b3-2 | vulnerable |
| Ubuntu | murano | 16.04 | 1:2.0.0~rc1-1 | vulnerable |
| Ubuntu | murano | 16.04 | 1:2.0.0~rc3-1 | vulnerable |
| Ubuntu | murano | 16.04 | 1:2.0.0-1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:4.0.0-0ubuntu1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:4.0.0-0ubuntu2 | vulnerable |
| Ubuntu | murano | 18.04 | 1:5.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:5.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:5.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:5.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | murano | 18.04 | 1:5.0.0-0ubuntu1 | vulnerable |
| Ubuntu | murano | 20.04 | 1:8.0.0-0ubuntu1 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0~b1~git2019121815.3afc74b1-0ubuntu1 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0~b1~git2019121815.3afc74b1-0ubuntu2 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0~b2~git2020020609.25ebd01d-0ubuntu1 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0~b2~git2020020609.25ebd01d-0ubuntu2 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0~b3~git2020041013.564f9cf3-0ubuntu1 | vulnerable |
| Ubuntu | murano | 20.04 | 1:9.0.0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | murano | 22.04 | 1:12.0.0-0ubuntu1 | vulnerable |
| Ubuntu | murano | 22.04 | 1:12.0.0+git2021120910.314c85db-0ubuntu1 | vulnerable |
| Ubuntu | murano | 22.04 | 1:12.0.0+git2022030313.f0258fc8-0ubuntu1 | vulnerable |
| Ubuntu | murano | 22.04 | 1:13.0.0-0ubuntu1 | vulnerable |
| Ubuntu | murano | 24.04 | 1:16.0.0-0ubuntu1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | murano | source | bookworm | (unfixed) | not yet assigned | Not reported | [1068459] |
Notes
[bookworm] murano: To be removed in point release
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-29156]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2024-29156]
- [https://security-tracker.debian.org/tracker/CVE-2024-29156]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-29156.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0940.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]