CVE-2023-1625

2023-03-2700:00:00

ubuntu.com

openstack heat

information leak

remote attacker

stack show command

confidentiality

integrity

availability

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

EPSS

0.001

Percentile

32.6%

JSON

An information leak was discovered in OpenStack heat. This issue could
allow a remote, authenticated attacker to use the ‘stack show’ command to
reveal parameters which are supposed to remain hidden. This has a low
impact to the confidentiality, integrity, and availability of the system.

Bugs

Notes

Author	Note
mdeslaur	fixed in jammy-updates and kinetic-updates as a SRU, but not yet in the -security pocket.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchheat< 1:10.0.2-0ubuntu1.1UNKNOWN
ubuntu20.04noarchheat< 1:14.2.0-0ubuntu1.1UNKNOWN
ubuntu22.04noarchheat< 1:18.0.1-0ubuntu1.1UNKNOWN
ubuntu16.04noarchheat< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	heat	< 1:10.0.2-0ubuntu1.1	UNKNOWN
ubuntu	20.04	noarch	heat	< 1:14.2.0-0ubuntu1.1	UNKNOWN
ubuntu	22.04	noarch	heat	< 1:18.0.1-0ubuntu1.1	UNKNOWN
ubuntu	16.04	noarch	heat	< any	UNKNOWN