Skip to content
OpenAdvisories
Unscored USN-2249-1 1 CVE

heat vulnerability

Published Jun 18, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Jason Dunsmore discovered that OpenStack heat did not properly restrict
access to template information. A remote authenticated attacker could
exploit this to see URL provider templates of other tenants for a limited
time.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS heat 2014.1-0ubuntu1.1

Vulnerabilities 1

  • Low —
    CVE-2014-3801

    OpenStack Heat template URL information leakage

    OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

    heat heat openstack-heat Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2014-3801