Difference between revisions of "OSSN/OSSN-0093"
(strengthen recommendation to disable or remove) |
(→Contacts / References: add assigned cve) |
||
(6 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
− | == | + | == Unsafe Environment Handling in MuranoPL == |
=== Summary === | === Summary === | ||
− | + | The Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information. Murano is an inactive project, so no fix is currently under development for this vulnerability. It is strongly recommended that any OpenStack deployments disable or fully remove Murano, if installed, at the earliest opportunity. | |
=== Affected Services / Software === | === Affected Services / Software === | ||
− | Murano | + | Murano (all versions) |
=== Discussion === | === Discussion === | ||
− | + | The YAQL interpreter project has released a new major version (3.0.0) which removes support for format strings, a feature necessary to exploit this condition in MuranoPL. Because Murano is not considered under active maintenance in OpenStack, its complete removal from all deployments is still strongly advised. | |
+ | |||
+ | Note that this behavior change in YAQL means configurations relying on string formatting will no longer be interpreted the same after upgrading, which could cause them to not work as intended by their users in services which accept YAQL (including Heat and Mistral). Reliance on that feature is considered to be unusual, but users should be made aware in case it negatively impacts their configuration. | ||
=== Recommended Actions === | === Recommended Actions === | ||
Disable the Murano service in, or fully remove it from, all OpenStack deployments at the earliest opportunity. | Disable the Murano service in, or fully remove it from, all OpenStack deployments at the earliest opportunity. | ||
+ | |||
+ | === Credits === | ||
+ | kirualawliet and Zhiniang Peng (@edwardzpeng) from Sangfor Security Research Team | ||
=== Contacts / References === | === Contacts / References === | ||
Line 21: | Line 26: | ||
'''Author:''' | '''Author:''' | ||
* Jeremy Stanley, OpenStack Vulnerability Coordinator | * Jeremy Stanley, OpenStack Vulnerability Coordinator | ||
+ | |||
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0093 | This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0093 | ||
− | Original LaunchPad Bug : https://launchpad.net/bugs/2048114 | + | Original LaunchPad Bug : https://launchpad.net/bugs/2048114 |
Mailing List : [security-sig] openstack-discuss@lists.openstack.org | Mailing List : [security-sig] openstack-discuss@lists.openstack.org | ||
+ | |||
+ | CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29156 |
Latest revision as of 14:18, 18 March 2024
Contents
Unsafe Environment Handling in MuranoPL
Summary
The Murano service's MuranoPL extension to the YAQL language fails to sanitize the supplied environment, leading to potential leakage of sensitive service account information. Murano is an inactive project, so no fix is currently under development for this vulnerability. It is strongly recommended that any OpenStack deployments disable or fully remove Murano, if installed, at the earliest opportunity.
Affected Services / Software
Murano (all versions)
Discussion
The YAQL interpreter project has released a new major version (3.0.0) which removes support for format strings, a feature necessary to exploit this condition in MuranoPL. Because Murano is not considered under active maintenance in OpenStack, its complete removal from all deployments is still strongly advised.
Note that this behavior change in YAQL means configurations relying on string formatting will no longer be interpreted the same after upgrading, which could cause them to not work as intended by their users in services which accept YAQL (including Heat and Mistral). Reliance on that feature is considered to be unusual, but users should be made aware in case it negatively impacts their configuration.
Recommended Actions
Disable the Murano service in, or fully remove it from, all OpenStack deployments at the earliest opportunity.
Credits
kirualawliet and Zhiniang Peng (@edwardzpeng) from Sangfor Security Research Team
Contacts / References
Author:
- Jeremy Stanley, OpenStack Vulnerability Coordinator
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0093
Original LaunchPad Bug : https://launchpad.net/bugs/2048114
Mailing List : [security-sig] openstack-discuss@lists.openstack.org
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29156