OpenStack Heat vulnerability

2014-06-1800:00:00

ubuntu.com

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

60.2%

JSON

Releases

Ubuntu 14.04 ESM

Packages

heat - OpenStack Orchestration Service

Details

Jason Dunsmore discovered that OpenStack heat did not properly restrict
access to template information. A remote authenticated attacker could
exploit this to see URL provider templates of other tenants for a limited
time.

OSVersionArchitecturePackageVersionFilename
Ubuntu14.04noarchpython-heat< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api-cfn< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api-cloudwatch< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-common< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-engine< 2014.1-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	14.04	noarch	python-heat	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api-cfn	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api-cloudwatch	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-common	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-engine	< 2014.1-0ubuntu1.1	UNKNOWN