PT-2014-5509 · Openstack+1 · Openstack Orchestration Api+1

Jason Dunsmore + 1 · Published 2014-05-23 · Updated 2022-05-14 · CVE-2014-3801

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Orchestration API (Heat) versions 2013.2 through 2013.2.3 OpenStack Orchestration API (Heat) version 2014.1

Description The issue allows remote authenticated users to obtain the provider template URL via the resource-type-list. This can occur when creating the stack for a template using a provider template.

Recommendations For OpenStack Orchestration API (Heat) versions 2013.2 through 2013.2.3, update to a version that includes the fix for this issue. For OpenStack Orchestration API (Heat) version 2014.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the resource-type-list to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3801

GHSA-86QJ-4H55-FVPW

RHSA-2014:1687

USN-2249-1

Affected Products

Openstack Orchestration Api

Ubuntu

References · 23

• http://rhn.redhat.com/errata/RHSA-2014-1687.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3801 · Security Note
• https://ubuntu.com/security/CVE-2014-3801 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3801 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3801 · Security Note
• http://ubuntu.com/usn/USN-2249-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86qj-4h55-fvpw · Vendor Advisory
• https://osv.dev/vulnerability/USN-2249-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3801 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2249-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3801 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3801 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3801 · Security Note
• https://web.archive.org/web/20200229061233/https://securityfocus.com/bid/67505 · Note
• http://openwall.com/lists/oss-security/2014/05/20/6 · Note