CVE-2014-3801

Priority
Medium
Description
OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when
creating the stack for a template using a provider template, allows remote
authenticated users to obtain the provider template URL via the
resource-type-list.
References
Bugs
Assigned-to
jdstrand
Package
Source: heat (LP Ubuntu Debian)
Upstream:released (2014.1.1-0ubuntu1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 13.10 (Saucy Salamander):ignored (reached end-of-life)
Ubuntu 14.04 LTS (Trusty Tahr):released (2014.1-0ubuntu1.1)
Ubuntu 14.10 (Utopic Unicorn):released (2014.1-0ubuntu3)
Patches:
Upstream:https://review.openstack.org/#/c/94625/ (icehouse)
Upstream:https://git.openstack.org/cgit/openstack/heat/commit/?id=03dd894de4ad905dc170e358fad27d9c8ed62a73
More Information

Valid XHTML 1.0 Strict

Updated: 2014-07-17 15:17:33 UTC (commit 8246)