{"id":"CVE-2024-7319","aliases":["DEBIAN-CVE-2024-7319","EUVD-2024-2462","GHSA-2fqr-cx7q-3ph8","PYSEC-2026-1750","UBUNTU-CVE-2024-7319"],"status":"published","title":"Openstack-heat: incomplete fix for cve-2023-1625","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00394,"percentile":0.33809,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2024-08-02T20:36:24Z","modified":"2026-11-02T12:03:12Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:19.0.0-3","1:20.0.0-1","1:20.0.0-2","1:20.0.0-3","1:20.0.0-4","1:20.0.0~rc1-1","1:20.0.0~rc1-2","1:21.0.0-1","1:21.0.0-2","1:21.0.0-3","1:21.0.0-4","1:21.0.0~rc1-1","1:22.0.0-1","1:22.0.0-2","1:22.0.0-3","1:22.0.0-4","1:22.0.0~rc1-1","1:23.0.0-1","1:23.0.0-2","1:23.0.0-3","1:23.0.0-4","1:23.0.0-5","1:23.0.0~rc1-1","1:23.0.0~rc1-2","1:24.0.0-1","1:24.0.0-2","1:24.0.0~rc1-1","1:24.0.0~rc1-2","1:25.0.0-1","1:25.0.0-2","1:25.0.0-3","1:25.0.0-4","1:25.0.0~rc1-1","1:25.0.0~rc1-2","1:25.0.0~rc1-3","1:25.0.0~rc1-4","1:25.0.0~rc1-5","1:26.0.0-1","1:26.0.0-2","1:26.0.0~rc1-1","1:26.0.0~rc1-2","1:26.0.1-1","1:27.0.0-1","1:27.0.0-2","1:27.0.0-3","1:27.0.0-4","1:27.0.0~rc1-1","1:27.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:24.0.0-2","1:25.0.0-1","1:25.0.0-2","1:25.0.0-3","1:25.0.0-4","1:25.0.0~rc1-1","1:25.0.0~rc1-2","1:25.0.0~rc1-3","1:25.0.0~rc1-4","1:25.0.0~rc1-5","1:26.0.0-1","1:26.0.0-2","1:26.0.0~rc1-1","1:26.0.0~rc1-2","1:26.0.1-1","1:27.0.0-1","1:27.0.0-2","1:27.0.0-3","1:27.0.0-4","1:27.0.0~rc1-1","1:27.0.0~rc1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:24.0.0-2","1:25.0.0-1","1:25.0.0-2","1:25.0.0-3","1:25.0.0-4","1:25.0.0~rc1-1","1:25.0.0~rc1-2","1:25.0.0~rc1-3","1:25.0.0~rc1-4","1:25.0.0~rc1-5","1:26.0.0-1","1:26.0.0-2","1:26.0.0~rc1-1","1:26.0.0~rc1-2","1:26.0.1-1","1:27.0.0-1","1:27.0.0-2","1:27.0.0-3","1:27.0.0-4","1:27.0.0~rc1-1","1:27.0.0~rc1-2"]},{"source":"osv","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.0.1"}]}],"versions":["11.0.0.0rc2.dev52","11.0.2","11.0.3","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.1.0","12.2.0","13.0.0","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.1.0","14.0.0","14.0.0.0rc1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.1.0","16.0.0","16.0.0.0rc1","16.1.0","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","17.0.2","18.0.0","18.0.0.0rc1","18.0.1","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","21.0.0","21.0.0.0rc1","21.0.1","22.0.0","22.0.0.0rc1","22.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"22.0.1"}]}],"versions":["11.0.0.0rc2.dev52","11.0.2","11.0.3","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.1.0","12.2.0","13.0.0","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.1.0","14.0.0","14.0.0.0rc1","14.1.0","14.2.0","15.0.0","15.0.0.0rc1","15.1.0","16.0.0","16.0.0.0rc1","16.1.0","17.0.0","17.0.0.0rc1","17.0.0.0rc2","17.0.1","17.0.2","18.0.0","18.0.0.0rc1","18.0.1","19.0.0","19.0.0.0rc1","19.0.0.0rc2","19.0.1","19.0.2","20.0.0","20.0.0.0rc1","20.0.0.0rc2","20.0.1","21.0.0","21.0.0.0rc1","21.0.1","22.0.0","22.0.0.0rc1","22.0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b2-0ubuntu1","1:6.0.0~b2-0ubuntu2","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.0-0ubuntu1.1","1:6.1.0-0ubuntu1","1:6.1.1-0ubuntu1","1:6.1.2-0ubuntu1","1:6.1.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b1-0ubuntu1","1:10.0.0~b2-0ubuntu1","1:10.0.0-0ubuntu1.1","1:10.0.1-0ubuntu1","1:10.0.1-0ubuntu2","1:10.0.2-0ubuntu1","1:10.0.2-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.0.0-0ubuntu1","1:14.0.0~b1~git2019121613.7b606461e-0ubuntu1","1:14.0.0~b2~git2020021413.94bdcd8c9-0ubuntu2","1:14.0.0~b3~git2020032414.d8354d908-0ubuntu1","1:14.0.0~b3~git2020041012.2ef9f4bf3-0ubuntu1","1:14.0.0-0ubuntu0.20.04.1","1:14.1.0-0ubuntu1","1:14.2.0-0ubuntu1","1:14.2.0-0ubuntu1.1","1:14.2.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.0.0-0ubuntu1","1:17.0.0+git2021120816.fe8fba8c9-0ubuntu2","1:17.0.0+git2022011216.9af3af156-0ubuntu1","1:17.0.0+git2022011216.9af3af156-0ubuntu3","1:17.0.1+git2022030311.968969b99-0ubuntu1","1:18.0.0-0ubuntu1","1:18.0.0-0ubuntu1.1","1:18.0.0-0ubuntu1.2","1:18.0.1-0ubuntu1","1:18.0.1-0ubuntu1.1","1:18.0.1-0ubuntu1.2","1:18.0.1-0ubuntu1.3","1:18.0.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:21.0.0-0ubuntu2","1:21.0.0-0ubuntu3","1:21.0.0+git2024011916.2df46d4c-0ubuntu1","1:22.0.0~rc1-0ubuntu1","1:22.0.0-0ubuntu1","1:22.0.0-0ubuntu2","1:22.0.1-0ubuntu1","1:22.0.1-0ubuntu1.1","1:22.0.1-0ubuntu1.2","1:22.0.1-0ubuntu1.3","1:22.0.1-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:24.0.0-0ubuntu1","1:25.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:26.0.0-0ubuntu1","1:26.0.0-0ubuntu2","1:26.0.0-0ubuntu3","1:26.0.0+git20260814.107.c4a566c-0ubuntu1","1:27.0.0~rc1-0ubuntu1","1:27.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:25.0.0-0ubuntu1","1:25.0.0+git20260124.b471f4a-0ubuntu1","1:26.0.0~rc1-0ubuntu1","1:26.0.0-0ubuntu1","1:26.0.0-0ubuntu1.1","1:26.0.0-0ubuntu1.2"]}],"products":[{"vendor":"openstack","product":"heat"},{"vendor":"red hat","product":"red hat openstack platform 13 (queens)"},{"vendor":"red hat","product":"red hat openstack platform 16.1"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.0"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-7319","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258810","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7319","tags":["advisory"]},{"url":"https://storyboard.openstack.org/#!/story/2011007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2fqr-cx7q-3ph8","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7319.json","tags":["advisory"]},{"url":"https://github.com/openstack/heat","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-7319","tags":["advisory"]},{"url":"https://pypi.org/project/openstack-heat","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-7319","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7319","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-7319","title":"Openstack-heat: incomplete fix for cve-2023-1625","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T20:36:24.314Z","modified":"2025-11-20T20:56:47.43Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2024-2462","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T20:36:24Z","modified":"2025-11-20T20:56:47Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:14.058235Z"}],"ghsa":[{"id":"GHSA-2fqr-cx7q-3ph8","title":"openstack-heat may disclose sensitive information","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T21:31:34Z","modified":"2024-09-24T18:38:56Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2024-7319","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T21:16:31.18Z","modified":"2026-06-17T08:19:50.83Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:10:17.832118Z"}],"osv":[{"id":"CVE-2024-7319","title":"Openstack-heat: incomplete fix for cve-2023-1625","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T20:36:24.314Z","modified":"2026-11-03T02:45:27.652565131Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-03T03:05:43.703218Z"},{"id":"DEBIAN-CVE-2024-7319","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T21:16:31.18Z","modified":"2026-11-02T12:03:12.230750959Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-2fqr-cx7q-3ph8","title":"openstack-heat may disclose sensitive information","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T21:31:34Z","modified":"2026-09-10T03:50:17.265394772Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:34.338541Z"},{"id":"PYSEC-2026-1750","title":"openstack-heat may disclose sensitive information","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2026-07-07T14:34:38.273529Z","modified":"2026-07-07T17:47:08.296791518Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2024-7319","description":"An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.","status":"published","published":"2024-08-02T21:16:00Z","modified":"2026-10-21T10:15:42.981327939Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"}]}}