Red Hat Security Advisory

RHSA-2014:0090

openstack-heat security, bug fix, and enhancement update

Released 2014-01-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 4.0 openstack-heat-2013.2.1-4.el6ost, openstack-heat-api-2013.2.1-4.el6ost, openstack-heat-api-cfn-2013.2.1-4.el6ost +3

Fixes 2 records

TI-2013-05381 CVE-2013-6428 · GHSA-xrx4-52w3-mpjx

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse…

LOW 22

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.01744 Published 2013-12-14 Partial fix CWE-264

TI-2013-05379 CVE-2013-6426 · GHSA-3m5x-89wr-x574

The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana…

LOW 21

The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intende…

CVSS 2.0MEDIUM 4.0 Network Low privileges Interaction — EPSS 0.0103 Published 2013-12-14 Partial fix CWE-264