{"id":"CVE-2023-1625","aliases":["DEBIAN-CVE-2023-1625","EUVD-2023-2428","GHSA-5836-grcc-8j89","PYSEC-2026-1751","SUSE-SU-2023:2378-1","SUSE-SU-2023:2379-1","UBUNTU-CVE-2023-1625","USN-6066-1","USN-6293-1"],"status":"published","title":"Information leak in api","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00715,"percentile":0.54074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-202"],"published":"2023-03-27T00:00:00Z","modified":"2026-10-28T02:30:35Z","fixes":[{"ecosystem":"PyPI","package":"openstack-heat","fixed_in":["20.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"heat","fixed_in":["1:19.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"heat","fixed_in":["1:19.0.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"heat","fixed_in":["1:19.0.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"heat","fixed_in":["1:10.0.2-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"heat","fixed_in":["1:14.2.0-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"heat","fixed_in":["1:18.0.1-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:19.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:19.0.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:19.0.0-2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.0"}]}],"versions":["11.0.0.0rc2.dev52","11.0.2","11.0.3","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.1.0","12.2.0","13.0.0","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.1.0","14.0.0","14.0.0.0rc1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.1.0","16.0.0","16.0.0.0rc1","16.1.0","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","17.0.2","18.0.0","18.0.0.0rc1","18.0.1","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","20.0.0.0rc1","20.0.0.0rc2"]},{"source":"osv","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.0.0"}]}],"versions":["11.0.0.0rc2.dev52","11.0.2","11.0.3","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.1.0","12.2.0","13.0.0","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.1.0","14.0.0","14.0.0.0rc1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.1.0","16.0.0","16.0.0.0rc1","16.1.0","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","17.0.2","18.0.0","18.0.0.0rc1","18.0.1","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","20.0.0.0rc1","20.0.0.0rc2"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.24.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-3.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.43.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.42.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.41.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.41.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-2.36.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.24.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3~dev3-3.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.1-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.2-3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.51.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.2-3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3~dev7-12.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-12.51.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2_5.0.2_5.0.2~dev31-11.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6~dev3-12.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.5~dev4-11.46.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.8~dev22-3.30.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Werkzeug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.2-3.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b2-0ubuntu1","1:6.0.0~b2-0ubuntu2","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.0-0ubuntu1.1","1:6.1.0-0ubuntu1","1:6.1.1-0ubuntu1","1:6.1.2-0ubuntu1","1:6.1.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.2-0ubuntu1.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1-0ubuntu1","1:10.0.0~b2-0ubuntu1","1:10.0.0-0ubuntu1.1","1:10.0.1-0ubuntu1","1:10.0.1-0ubuntu2","1:10.0.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.2.0-0ubuntu1.1"}]}],"versions":["1:13.0.0-0ubuntu1","1:14.0.0~b1~git2019121613.7b606461e-0ubuntu1","1:14.0.0~b2~git2020021413.94bdcd8c9-0ubuntu2","1:14.0.0~b3~git2020032414.d8354d908-0ubuntu1","1:14.0.0~b3~git2020041012.2ef9f4bf3-0ubuntu1","1:14.0.0-0ubuntu0.20.04.1","1:14.1.0-0ubuntu1","1:14.2.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.1-0ubuntu1.1"}]}],"versions":["1:17.0.0-0ubuntu1","1:17.0.0+git2021120816.fe8fba8c9-0ubuntu2","1:17.0.0+git2022011216.9af3af156-0ubuntu1","1:17.0.0+git2022011216.9af3af156-0ubuntu3","1:17.0.1+git2022030311.968969b99-0ubuntu1","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu1.1","1:18.0.0-0ubuntu1.2","1:18.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.2-0ubuntu1.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1-0ubuntu1","1:10.0.0~b2-0ubuntu1","1:10.0.0-0ubuntu1.1","1:10.0.1-0ubuntu1","1:10.0.1-0ubuntu2","1:10.0.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.2.0-0ubuntu1.1"}]}],"versions":["1:13.0.0-0ubuntu1","1:14.0.0~b1~git2019121613.7b606461e-0ubuntu1","1:14.0.0~b2~git2020021413.94bdcd8c9-0ubuntu2","1:14.0.0~b3~git2020032414.d8354d908-0ubuntu1","1:14.0.0~b3~git2020041012.2ef9f4bf3-0ubuntu1","1:14.0.0-0ubuntu0.20.04.1","1:14.1.0-0ubuntu1","1:14.2.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.0.1-0ubuntu1.1"}]}],"versions":["1:17.0.0-0ubuntu1","1:17.0.0+git2021120816.fe8fba8c9-0ubuntu2","1:17.0.0+git2022011216.9af3af156-0ubuntu1","1:17.0.0+git2022011216.9af3af156-0ubuntu3","1:17.0.1+git2022030311.968969b99-0ubuntu1","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu1.1","1:18.0.0-0ubuntu1.2","1:18.0.1-0ubuntu1"]}],"products":[{"vendor":"openstack","product":"heat"},{"vendor":"rdo","product":"openstack rdo"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.0"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-1625","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181621","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb","tags":["x_transferred","Patch","fix","web"]},{"url":"https://launchpad.net/bugs/1999665","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1625","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5836-grcc-8j89","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://repos.fedorapeople.org/repos/openstack/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1625.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1625","tags":["advisory"]},{"url":"https://github.com/openstack/heat","tags":["package"]},{"url":"https://pypi.org/project/openstack-heat","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232378-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207035","tags":["report"]},{"url":"https://bugzilla.suse.com/1208283","tags":["report"]},{"url":"https://bugzilla.suse.com/1209774","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25577","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232379-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-1625","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6066-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6293-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1625","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-1625","title":"Information leak in api","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T00:08:12.738Z","modified":"2024-09-24T14:59:25.505Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-202"],"updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-2428","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T00:08:12Z","modified":"2024-09-24T14:59:25Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:28:15.73715Z"}],"ghsa":[{"id":"GHSA-5836-grcc-8j89","title":"OpenStack Heat information leak vulnerability","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2023-11-09T05:04:52Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:17.64478Z"}],"nvd":[{"id":"CVE-2023-1625","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T01:15:43.577Z","modified":"2026-06-17T05:28:23.837Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-202"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"CVE-2023-1625","title":"Information leak in api","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T00:08:12.738Z","modified":"2026-10-28T02:30:35.777140928Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-202"],"updated_at":"2026-11-02T15:44:30.334753Z"},{"id":"DEBIAN-CVE-2023-1625","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T01:15:43.577Z","modified":"2026-10-26T18:00:16.150190131Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-5836-grcc-8j89","title":"OpenStack Heat information leak vulnerability","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-09-24T03:30:20Z","modified":"2026-07-07T17:57:34.360423586Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"PYSEC-2026-1751","title":"OpenStack Heat information leak vulnerability","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2026-07-07T11:45:24.819136Z","modified":"2026-07-07T17:46:23.9756972Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2023-1625","description":"An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.","status":"published","published":"2023-03-27T00:00:00Z","modified":"2026-02-04T03:47:19.242805Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"SUSE-SU-2023:2378-1","title":"Security update for openstack-heat, openstack-swift, python-Werkzeug","description":"This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes:\n\nSecurity fixes included in this update:\n\nopenstack-heat:\n- CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment (bsc#1209774).\n\nopenstack-swift:\n- CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035).\n\npython-Werkzeug:\n- CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283).\n\nNon security changes on this update:\n\nChanges in openstack-heat:\n- Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625)\n\nChanges in openstack-swift:\n- Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950)\n\nChanges in python-Werkzeug;\n- Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)\n  ","status":"published","published":"2023-06-05T14:38:36Z","modified":"2026-02-04T04:38:42.226506Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:2379-1","title":"Security update for openstack-heat, python-Werkzeug","description":"This update for openstack-heat, python-Werkzeug contains the following fixes:\n\nSecurity fixes included on this update:\n\nopenstack-heat:\n- CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment. (bsc#1209774)\n\npython-Werkzeug:\n- CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields. (bsc#1208283)\n  ","status":"published","published":"2023-06-05T14:39:04Z","modified":"2026-02-04T03:29:28.564346Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6066-1","title":"heat vulnerability","description":"It was discovered that OpenStack Heat incorrectly handled certain hidden\nparameter values. A remote authenticated user could possibly use this issue\nto obtain sensitive data.\n","status":"published","published":"2023-05-10T11:18:02Z","modified":"2026-04-27T16:39:53.474493Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6293-1","title":"heat vulnerability","description":"It was discovered that OpenStack Heat incorrectly handled certain hidden\nparameter values. A remote authenticated user could possibly use this issue\nto obtain sensitive data.\n","status":"published","published":"2023-08-16T12:17:32Z","modified":"2026-04-27T16:48:08.230792Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}