CVE-2023-1625
Fixed in a distro release EPSS <1%CVSS 7.4
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
Products: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.1, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.0, OpenStack RDO
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | openstack-heat | 20.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | heat | 1:19.0.0-2 |
| Debian 13 | heat | 1:19.0.0-2 |
| Debian 14 | heat | 1:19.0.0-2 |
| SUSE HPE Helion OpenStack 8 | openstack-heat | 9.0.8~dev22-3.30.3 |
| SUSE HPE Helion OpenStack 8 | openstack-heat-doc | 9.0.8~dev22-3.30.3 |
| SUSE HPE Helion OpenStack 8 | python-Werkzeug | 0.12.2-3.6.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-designate | 5.0.3~dev7-12.45.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-heat | 9.0.8~dev22-12.51.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-octavia | 1.0.6~dev3-12.47.1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-sahara | 7.0.5~dev4-11.46.1 |
| SUSE OpenStack Cloud 8 | openstack-heat | 9.0.8~dev22-3.30.3 |
| SUSE OpenStack Cloud 8 | openstack-heat-doc | 9.0.8~dev22-3.30.3 |
| SUSE OpenStack Cloud 8 | python-Werkzeug | 0.12.2-3.6.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-designate | 5.0.3~dev7-12.45.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-heat | 9.0.8~dev22-12.51.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-magnum | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-octavia | 1.0.6~dev3-12.47.1 |
| SUSE OpenStack Cloud 8 | venv-openstack-sahara | 7.0.5~dev4-11.46.1 |
| SUSE OpenStack Cloud 9 | openstack-heat | 11.0.4~dev4-3.24.4 |
| SUSE OpenStack Cloud 9 | openstack-swift | 2.19.3~dev3-3.6.3 |
| SUSE OpenStack Cloud 9 | python-Werkzeug | 0.14.1-3.6.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-designate | 7.0.2~dev2-3.41.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-heat | 11.0.4~dev4-3.43.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-keystone | 14.2.1~dev9-3.42.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-magnum | 7.2.1~dev1-4.41.3 |
| SUSE OpenStack Cloud 9 | venv-openstack-octavia | 3.2.3~dev7-4.41.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-sahara | 9.0.2~dev15-3.41.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-swift | 2.19.3~dev3-2.36.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat | 9.0.8~dev22-3.30.3 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-heat-doc | 9.0.8~dev22-3.30.3 |
| SUSE OpenStack Cloud Crowbar 8 | python-Werkzeug | 0.12.2-3.6.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat | 11.0.4~dev4-3.24.4 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-swift | 2.19.3~dev3-3.6.3 |
| SUSE OpenStack Cloud Crowbar 9 | python-Werkzeug | 0.14.1-3.6.2 |
| Ubuntu 16.04 LTS | heat | no fix |
| Ubuntu 18.04 LTS | heat | 1:10.0.2-0ubuntu1.1 |
| Ubuntu 20.04 LTS | heat | 1:14.2.0-0ubuntu1.1 |
| Ubuntu 22.04 LTS | heat | 1:18.0.1-0ubuntu1.1 |