CVE-2024-29156

Name of the Vulnerable Software and Affected Versions: OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0

Description: The issue is related to the Murano service's MuranoPL extension to the YAQL language, which fails to sanitize the supplied environment. This could lead to potential leakage of sensitive service account information.

Recommendations: For OpenStack Murano versions prior to 16.0.0 with YAQL versions prior to 3.0.0, consider disabling the Murano service or fully removing it from all OpenStack deployments as a temporary workaround until a patch is available.