OpenStack Heat template URL information leakage

NIEDRIG 3.5CVE-2014-3801 · GHSA-86qj-4h55-fvpw · PYSEC-2026-889 · Published 23/05/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
openstack-heat PyPI	`< 5.0.0a0`	`5.0.0a0`
heat openstack	`= 2013.2= 2013.2.1= 2013.2.2= 2013.2.3= 2014.1`	No fix yet

Description

OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-3801 · ADVISORY
bugs.launchpad.net/heat/+bug/1311223 · WEB
git.openstack.org/cgit/openstack/heat · PACKAGE
git.openstack.org/cgit/openstack/heat/commit · WEB
git.openstack.org/cgit/openstack/heat/commit · WEB
git.openstack.org/cgit/openstack/heat/commit · WEB
web.archive.org/web/20200229061233/https://www.securityfocus.com/bid/67505 · WEB
rhn.redhat.com/errata/RHSA-2014-1687.html · WEB
openwall.com/lists/oss-security/2014/05/20/1 · WEB
openwall.com/lists/oss-security/2014/05/20/6 · WEB
ubuntu.com/usn/USN-2249-1 · WEB
securityfocus.com/bid/67505
pypi.org/project/openstack-heat · PACKAGE
GitHub Advisory GHSA-86qj-4h55-fvpw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free