Log in Start free

Vulnerability · Published Sep 24, 2023 · Assigned by redhat

CVE-2023-1625Information leak in api

High 7.4

In plain English

A high-severity security flaw in openstack-heat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.7%top 46.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12heat1:19.0.0-2DEBIAN-CVE-2023-1625
Debian:13heat1:19.0.0-2DEBIAN-CVE-2023-1625
Debian:14heat1:19.0.0-2DEBIAN-CVE-2023-1625
PyPIopenstack-heat20.0.0GHSA-5836-grcc-8j89
PyPIopenstack-heat20.0.0PYSEC-2026-1751
Ubuntu:22.04:LTSheat1:18.0.1-0ubuntu1.1USN-6293-1
Ubuntu:22.04:LTSheat1:18.0.1-0ubuntu1.1UBUNTU-CVE-2023-1625

Affected products (as reported)

VendorProductVersions
n/a openstack-heat see references
Red Hat Red Hat OpenStack Platform 13 (Queens) see references
Red Hat Red Hat OpenStack Platform 16.1 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 17.0 see references
RDO OpenStack RDO see references

Weakness: CWE-202 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

References