Candidate: CVE-2015-5295
PublicDate: 2016-01-20 16:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5295
 http://seclists.org/oss-sec/2016/q1/137
Description:
 The template-validate command in OpenStack Orchestration API (Heat) before
 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote
 authenticated users to cause a denial of service (memory consumption) or
 determine the existence of local files via the resource type in a template,
 as demonstrated by file:///dev/zero.
Ubuntu-Description:
Notes:
 tyhicks> affects Heat <=2015.1.2, ==5.0.0
Bugs:
 https://launchpad.net/bugs/1496277
Priority: low
Discovered-by: Steven Hardy
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L [5.4 MEDIUM]

Patches_heat:
 upstream: https://review.openstack.org/#/c/269689/ (master)
 upstream: https://review.openstack.org/#/c/269692/ (kilo)
 other: https://bugs.launchpad.net/heat/+bug/1496277/comments/80 (icehouse)
upstream_heat: needs-triage
precise_heat: DNE
precise/esm_heat: DNE
trusty_heat: ignored (reached end-of-life)
trusty/esm_heat: DNE (trusty was needed)
vivid_heat: ignored (reached end-of-life)
vivid/stable-phone-overlay_heat: DNE
vivid/ubuntu-core_heat: DNE
wily_heat: ignored (reached end-of-life)
xenial_heat: not-affected (1:6.0.0~b1-0ubuntu1)
esm-infra/xenial_heat: not-affected (1:6.0.0~b1-0ubuntu1)
yakkety_heat: not-affected (1:6.0.0~b1-0ubuntu1)
zesty_heat: not-affected (1:6.0.0~b1-0ubuntu1)
artful_heat: not-affected (1:6.0.0~b1-0ubuntu1)
bionic_heat: not-affected (1:6.0.0~b1-0ubuntu1)
cosmic_heat: not-affected (1:6.0.0~b1-0ubuntu1)
disco_heat: not-affected (1:6.0.0~b1-0ubuntu1)
devel_heat: not-affected (1:6.0.0~b1-0ubuntu1)