Red Hat Security AdvisoryRHSA-2017:1464
openstack-heat security and bug fix update
Released 2017-06-14 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenStack Platform 9.0 openstack-heat-1:6.1.0-3.el7ost, openstack-heat-api-1:6.1.0-3.el7ost, openstack-heat-api-cfn-1:6.1.0-3.el7ost +4
Fixes 2 records
Priority LOW 25
An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00413 · Published 2018-07-27 · Fixed CWE-552
Priority LOW 23
In OpenStack Heat, by launching a new Heat stack with a local URL an authenticated user may conduct network discovery revealing internal network configuration.
CVSS 3.0MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01537 · Published 2016-11-04 · Partial fix CWE-200
