Murano PL Extension Vulnerability Leads to Sensitive Service Account Information Leak

CVE-2024-29156
Currently unrated 🤨

Key Information

Vendor
OpenStack
Vendor
CVE Published:
18 March 2024

Summary

In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.