PT-2016-3680 · Openstack · Openstack Orchestration Api

Steven Hardy · CVE-2015-5295 · Published 2016-01-20 · Updated 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Orchestration API (Heat) versions prior to 2015.1.3 OpenStack Orchestration API (Heat) versions 5.0.x prior to 5.0.1

Description The issue allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template. This can be demonstrated by using the file:///dev/zero resource type in a template.

Recommendations For versions prior to 2015.1.3, update to version 2015.1.3 or later. For versions 5.0.x prior to 5.0.1, update to version 5.0.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2015-5295

RHSA-2016:0266

RHSA-2016:0440

RHSA-2016:0441

RHSA-2016:0442

Affected Products

Openstack Orchestration Api

References · 15

• https://security.openstack.org/ossa/OSSA-2016-003.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5295 · Vendor Advisory
• https://bugs.launchpad.net/heat/+bug/1496277 · Patch
• https://osv.dev/vulnerability/CVE-2015-5295 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176700.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-5295 · Security Note
• https://ubuntu.com/security/CVE-2015-5295 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5295 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5295 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5295 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-0266.html · Vendor Advisory
• http://securityfocus.com/bid/81438 · Note
• http://oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html · Note
• http://seclists.org/oss-sec/2016/q1/137 · Note
• https://t.me/cvenotify/44183 · Telegram Post