GitHub Advisoryadvisory · PyPI

GHSA-mvf6-hwxh-7v76 Information leakage in YAQL

MEDIUM Published 2024-03-18 Modified 2025-03-26 Official page ↗
Aliases
CVE-2024-29156
Ecosystem
PyPI
Packages
yaql
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-116, CWE-200
Reviewed
2024-03-18

Affected packages

• PyPI yaql: < 3.0.0 → fixed in 3.0.0

Description

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

Related

Alias · CVE (1)

  • CVE-2024-29156 In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to… vulnerability

Weakness · CWE (2)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References