Total vulnerabilities in the database
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
| Software | From | Fixed in |
|---|---|---|
| openstack / orchestration_api | 5.0.0 | 5.0.1 |
| openstack / orchestration_api | 2015.1.0 | 2015.1.3 |
| redhat / openstack | 7.0 | 7.0.x |
| oracle / solaris | 11.3 | 11.3.x |
| fedoraproject / fedora | 23 | 23.x |