Description
In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | murano | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | murano | No fix yet | — |
| Ubuntu 22.04 LTS | murano | No fix yet | — |
| Ubuntu 20.04 LTS | murano | No fix yet | — |
| Ubuntu 18.04 LTS | murano | No fix yet | — |
| Ubuntu 16.04 LTS | murano | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | openstack-tripleo-heat-templates | 14.3.1-17.1.20231103003748.2.el8ost | RHSA-2024:1931, RHSA-2024:1930 |
| Red Hat OpenStack 17 | python-yaql +1 | 1.1.3-11.el8ost | RHSA-2024:1931, RHSA-2024:1930 |
| Red Hat OpenStack 16 | openstack-tripleo-heat-templates | 11.6.1-2.20230808225220.el8ost | RHSA-2024:4053 |
| Red Hat OpenStack 16 | python-yaql +1 | 1.1.3-9.el8ost | RHSA-2024:4053 |
| Red Hat OpenStack 16 | python3-tripleo-common +4 | 11.7.1-2.20230809225405.e189622.el8ost | RHSA-2024:4053 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | yaql | < 3.0.0 | 3.0.0 | GHSA-mvf6-hwxh-7v76 |
Advisories 4
- RHSA-2024:4053 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- RHSA-2024:1930 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (openstack-tripleo-heat-templates and python-yaql) security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- RHSA-2024:1931 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (python-yaql and openstack-tripleo-heat-templates) security update Red Hat Security Advisories (RHSA) · Aug 4, 2026
- WID-SEC-2024-0940 Red Hat OpenStack: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Jun 23, 2024