What is GHSA-mvf6-hwxh-7v76?

GHSA-mvf6-hwxh-7v76 is a security advisory published by GitHub Security Advisories with Medium severity. Information leakage in YAQL

Which CVE IDs does GHSA-mvf6-hwxh-7v76 cover?

GHSA-mvf6-hwxh-7v76 covers the following CVE IDs: CVE-2024-29156. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mvf6-hwxh-7v76?

GHSA-mvf6-hwxh-7v76 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-mvf6-hwxh-7v76?

GHSA-mvf6-hwxh-7v76 affects 1 product, including: pip/yaql:\u003c 3.0.0.

GHSA-mvf6-hwxh-7v76MediumCVSS 6.5

Information leakage in YAQL

Vendor

GitHub Security Advisories

Published

March 18, 2024

Last Modified

March 26, 2025

🔗 CVE IDs covered (1)

CVE-2024-29156 →

📋 Description

YAQL before 3.0.0 is used in Murano, the Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information.

🎯 Affected products1

pip/yaql:< 3.0.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2024-29156
https://launchpad.net/bugs/2048114
https://opendev.org/openstack/murano/tags
https://opendev.org/openstack/yaql/commit/83e28324e1a0ce3970dd854393d2431123a909d3
https://wiki.openstack.org/wiki/OSSN/OSSN-0093
https://bugs.launchpad.net/murano/+bug/2048114
https://github.com/advisories/GHSA-mvf6-hwxh-7v76