CVE-2015-5295 The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consu...
MediumCVSS 5.4
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/heat(Debian:12) | < 1:6.0.0~rc3-1 | 1:6.0.0~rc3-1 |
| debian/heat(Debian:13) | < 1:6.0.0~rc3-1 | 1:6.0.0~rc3-1 |
| debian/heat(Debian:14) | < 1:6.0.0~rc3-1 | 1:6.0.0~rc3-1 |
| OpenStack orchestration api | >= 5.0.0, < 5.0.1 | 5.0.1 |
| OpenStack orchestration api | >= 2015.1.0, < 2015.1.3 | 2015.1.3 |
| redhat openstack | = 7.0 | No fix listed |
| fedoraproject fedora | = 23 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
References
- Debian Security Tracker CVE-2015-5295 vendor-advisory
- FEDORA-2016-fe5b9da308 mailing-list third-party-advisory vendor-advisory
- RHSA-2016:0266 third-party-advisory vendor-advisory
- www.oracle.com third-party-advisory
- 81438 third-party-advisory vdb-entry
- bugs.launchpad.net patch third-party-advisory
- security.openstack.org vendor-advisory