OpenStack Heat vulnerability

2014-06-1800:00:00

ubuntu.com

6.2 Medium

AI Score

Confidence

Low

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

59.8%

JSON

Releases

Ubuntu 14.04 ESM

Packages

heat - OpenStack Orchestration Service

Details

Jason Dunsmore discovered that OpenStack heat did not properly restrict
access to template information. A remote authenticated attacker could
exploit this to see URL provider templates of other tenants for a limited
time.

OSVersionArchitecturePackageVersionFilename
Ubuntu14.04noarchpython-heat< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api-cfn< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-api-cloudwatch< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-common< 2014.1-0ubuntu1.1UNKNOWN
Ubuntu14.04noarchheat-engine< 2014.1-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	14.04	noarch	python-heat	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api-cfn	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-api-cloudwatch	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-common	< 2014.1-0ubuntu1.1	UNKNOWN
Ubuntu	14.04	noarch	heat-engine	< 2014.1-0ubuntu1.1	UNKNOWN