Log in Start free

Vulnerability · Published Aug 2, 2024 · Assigned by redhat

CVE-2024-7319Openstack-heat: incomplete fix for cve-2023-1625

Medium 5.0

In plain English

A medium-severity information exposure in openstack-heat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.4%top 66.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12heatno fix listedDEBIAN-CVE-2024-7319
Debian:13heatno fix listedDEBIAN-CVE-2024-7319
Debian:14heatno fix listedDEBIAN-CVE-2024-7319
PyPIopenstack-heatno fix listedGHSA-2fqr-cx7q-3ph8
PyPIopenstack-heatno fix listedPYSEC-2026-1750
Ubuntu:22.04:LTSheatno fix listedUBUNTU-CVE-2024-7319
Ubuntu:24.04:LTSheatno fix listedUBUNTU-CVE-2024-7319
Ubuntu:25.10heatno fix listedUBUNTU-CVE-2024-7319
Ubuntu:26.04:LTSheatno fix listedUBUNTU-CVE-2024-7319
Ubuntu:26.10heatno fix listedUBUNTU-CVE-2024-7319

Affected products (as reported)

VendorProductVersions
openstack-heat 0 – through 22.0.1
Red Hat Red Hat OpenStack Platform 13 (Queens) see references
Red Hat Red Hat OpenStack Platform 16.1 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 17.0 see references

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

References