Skip to content
OpenAdvisories
Medium RHSA-2024:4053 1 CVE

Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security update

Published Sep 16, 2024 · Updated Aug 4, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · OpenStack 16 openstack:16.2::el8 openstack-tripleo-common 0:11.7.1-2.20230809225405.e189622.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 openstack-tripleo-common-container-base 0:11.7.1-2.20230809225405.e189622.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 openstack-tripleo-common-containers 0:11.7.1-2.20230809225405.e189622.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 openstack-tripleo-common-devtools 0:11.7.1-2.20230809225405.e189622.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 openstack-tripleo-heat-templates 0:11.6.1-2.20230808225220.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 python-yaql 0:1.1.3-9.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 python3-tripleo-common 0:11.7.1-2.20230809225405.e189622.el8ost
Red Hat · OpenStack 16 openstack:16.2::el8 python3-yaql 0:1.1.3-9.el8ost

Vulnerabilities 1

  • Medium 6.5
    CVE-2024-29156

    Information leakage in YAQL

    In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

    murano murano yaql Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2269112
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4053.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-29156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-29156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-29156
  • article
    https://bugs.launchpad.net/murano/+bug/2048114