PT-2014-5509 · Openstack+1 · Openstack Orchestration Api+1

Jason Dunsmore + 1 · Publicado 2014-05-23 · Atualizado 2022-05-14 · CVE-2014-3801

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Orchestration API (Heat) versions 2013.2 through 2013.2.3 OpenStack Orchestration API (Heat) version 2014.1

Description The issue allows remote authenticated users to obtain the provider template URL via the resource-type-list. This can occur when creating the stack for a template using a provider template.

Recommendations For OpenStack Orchestration API (Heat) versions 2013.2 through 2013.2.3, update to a version that includes the fix for this issue. For OpenStack Orchestration API (Heat) version 2014.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the resource-type-list to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3801

GHSA-86QJ-4H55-FVPW

RHSA-2014:1687

USN-2249-1

Produtos afetados

Openstack Orchestration Api

Ubuntu

Referências · 23

• http://rhn.redhat.com/errata/RHSA-2014-1687.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3801 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-3801 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3801 · Aviso do Fabricante
• https://web.archive.org/web/20200229061233/https://securityfocus.com/bid/67505 · Nota
• https://cve.org/CVERecord?id=CVE-2014-3801 · Nota de Segurança
• http://ubuntu.com/usn/USN-2249-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/05/20/6 · Nota
• https://osv.dev/vulnerability/GHSA-86qj-4h55-fvpw · Aviso do Fabricante
• https://git.openstack.org/cgit/openstack/heat/commit/?id=a02ff20509171346d2a1d2a9df7c81aada134c52 · Nota
• https://osv.dev/vulnerability/USN-2249-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-3801 · Aviso do Fabricante
• https://git.openstack.org/cgit/openstack/heat/commit/?id=7e114a38712da8947ee7ad93eabda34f5e4aa65a · Nota
• https://ubuntu.com/security/notices/USN-2249-1 · Aviso do Fabricante
• https://launchpad.net/bugs/1311223 · Nota