CVE-2023-1625 Information leak in api

What is CVE-2023-1625?

CVE-2023-1625 is a high-severity vulnerability in OpenStack RDO, published on 24 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.

Weakness: CWE-202

Which versions are affected by CVE-2023-1625?

3 open source packages ship an affected version, including openstack-heat. It affects 2 products.

Products include Openstack Heat, Redhat Openstack Platform.

How do I fix CVE-2023-1625?

Upgrade openstack-heat to 20.0.0 or later.

Is CVE-2023-1625 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-1625 exists.

Other vulnerabilities in OpenStack RDO

• CVE-2017-2621 Information disclosure in openstack-heat Medium 5.9
• CVE-2024-7319 Openstack-heat: incomplete fix for cve-2023-1625 Medium 5.0
• CVE-2016-9185 Server-side request forgery in n/a Medium 4.3
• CVE-2013-6426 Missing authorization in n/a Medium 4.0
• CVE-2013-6428 Auth bypass in n/a Medium 4.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-1625, GHSA-5836-grcc-8j89, PYSEC-2026-1751, UBUNTU-CVE-2023-1625, USN-6066-1, USN-6293-1.