heat

4 results · Feed

• High 7.5
  CVE-2025-65073

  OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

  OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.

  OpenStack Keystone keystone keystone Debian Ubuntu PyPI
  Nov 17, 2025
• Medium 5.0
  CVE-2024-7319

  Openstack-heat: incomplete fix for cve-2023-1625

  An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

  Red Hat Red Hat OpenStack Platform 13 (Queens) Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 16.1 Debian Ubuntu PyPI
  Aug 2, 2024
• High 7.4
  CVE-2023-1625

  Information leak in api

  An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, an…

  Red Hat RDO Red Hat OpenStack Platform 13 (Queens) Red Hat OpenStack Platform 16.2 Debian Ubuntu PyPI
  Sep 24, 2023
• Low —
  CVE-2014-3801

  OpenStack Heat template URL information leakage

  OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.

  heat heat openstack-heat Debian Ubuntu PyPI
  May 23, 2014