Skip to content
OpenAdvisories
Unscored RHSA-2014:1687 1 CVE

Red Hat Security Advisory: openstack-heat security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat-api 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat-api-cfn 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat-api-cloudwatch 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat-common 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-heat-engine 0:2013.2.4-1.el6ost

Vulnerabilities 1

  • Low —
    CVE-2014-3801

    OpenStack Heat template URL information leakage

    OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

    heat heat openstack-heat Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.4
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1082672
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1085996
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1099748
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1124137
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1146092
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1687.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-3801
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3801
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3801