Headline
Ubuntu Security Notice USN-6066-1
Ubuntu Security Notice 6066-1 - It was discovered that OpenStack Heat incorrectly handled certain hidden parameter values. A remote authenticated user could possibly use this issue to obtain sensitive data.
==========================================================================
Ubuntu Security Notice USN-6066-1
May 10, 2023
heat vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
OpenStack Heat could be made to expose sensitive information.
Software Description:
- heat: OpenStack Orchestration Service
Details:
It was discovered that OpenStack Heat incorrectly handled certain hidden
parameter values. A remote authenticated user could possibly use this issue
to obtain sensitive data.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
python3-heat 1:14.2.0-0ubuntu1.1
Ubuntu 18.04 LTS:
python-heat 1:10.0.2-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6066-1
CVE-2023-1625
Package Information:
https://launchpad.net/ubuntu/+source/heat/1:14.2.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/heat/1:10.0.2-0ubuntu1.1
Related news
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
Ubuntu Security Notice 6293-1 - It was discovered that OpenStack Heat incorrectly handled certain hidden parameter values. A remote authenticated user could possibly use this issue to obtain sensitive data.