PT-2016-3680 · Openstack · Openstack Orchestration Api

Steven Hardy · Publicado 2016-01-20 · Atualizado 2023-02-13 · CVE-2015-5295

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Orchestration API (Heat) versions prior to 2015.1.3 OpenStack Orchestration API (Heat) versions 5.0.x prior to 5.0.1

Description The issue allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template. This can be demonstrated by using the file:///dev/zero resource type in a template.

Recommendations For versions prior to 2015.1.3, update to version 2015.1.3 or later. For versions 5.0.x prior to 5.0.1, update to version 5.0.1 or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-5295

RHSA-2016:0266

RHSA-2016:0440

RHSA-2016:0441

RHSA-2016:0442

Produtos afetados

Openstack Orchestration Api

Referências · 15

• https://security.openstack.org/ossa/OSSA-2016-003.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5295 · Aviso do Fabricante
• https://bugs.launchpad.net/heat/+bug/1496277 · Correção
• https://osv.dev/vulnerability/CVE-2015-5295 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176700.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-5295 · Nota de Segurança
• https://ubuntu.com/security/CVE-2015-5295 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-5295 · Aviso do Fabricante
• http://securityfocus.com/bid/81438 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5295 · Aviso do Fabricante
• http://oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html · Nota
• http://seclists.org/oss-sec/2016/q1/137 · Nota
• https://t.me/cvenotify/44183 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-5295 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2016-0266.html · Aviso do Fabricante