Skip to content
Fencer Vulns
high 7.4

CVE-2023-1625 json

Information leak in api

published 2023-09-24 3 y ago modified 2026-07-07 4 mo ago also GHSA-5836-grcc-8j89 , PYSEC-2026-1751 , EUVD-2023-2428

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.

Patch / fix

  • pypi openstack-heat 20.0.0
  • heat Debian 14, Debian 13, Debian 12 1:19.0.0-2

debian advisories DEBIAN-CVE-2023-1625

  • heat Ubuntu 18.04 LTS 1:10.0.2-0ubuntu1.1
  • heat Ubuntu 20.04 LTS 1:14.2.0-0ubuntu1.1
  • heat Ubuntu 22.04 LTS 1:18.0.1-0ubuntu1.1

ubuntu advisories UBUNTU-CVE-2023-1625

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-Werkzeug OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 0.12.2-3.6.2
  • openstack-heat OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-3.30.3
  • venv-openstack-heat OpenStack Cloud 8, HPE Helion OpenStack 8 9.0.8~dev22-12.51.1
  • venv-openstack-magnum OpenStack Cloud 8, HPE Helion OpenStack 8 5.0.2_5.0.2_5.0.2~dev31-11.46.1
  • venv-openstack-sahara OpenStack Cloud 8, HPE Helion OpenStack 8 7.0.5~dev4-11.46.1
  • venv-openstack-octavia OpenStack Cloud 8, HPE Helion OpenStack 8 1.0.6~dev3-12.47.1
  • venv-openstack-designate OpenStack Cloud 8, HPE Helion OpenStack 8 5.0.3~dev7-12.45.1
  • python-Werkzeug OpenStack Cloud Crowbar 9, OpenStack Cloud 9 0.14.1-3.6.2

suse advisories SUSE-SU-2023:2379-1SUSE-SU-2023:2378-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-1625 updated cvss 7.4

openstack-heat: information leak in API

  • Red Hat OpenStack Platform 13 (Queens) openstack-heat-api, openstack-heat-common, openstack-heat-engine, openstack-heat-api-cfn, openstack-heat-monolith
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 16.1 openstack-heat-api, openstack-heat-common, openstack-heat-engine, openstack-heat-api-cfn, openstack-heat-monolith Red Hat OpenStack Platform 16.2 openstack-heat-api, openstack-heat-common, openstack-heat-engine, openstack-heat-api-cfn, openstack-heat-monolith
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 17.0 openstack-heat-api, openstack-heat-common, openstack-heat-engine, openstack-heat-api-cfn, openstack-heat-monolith
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • launchpad.net https://launchpad.net/bugs/1999665 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
GitHub 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
OSV 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
pypi openstack-heat
<20.0.0
20.0.0

Affected products

  • n/a openstack-heat
  • Red Hat Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Red Hat OpenStack Platform 16.1
  • Red Hat Red Hat OpenStack Platform 16.2
  • Red Hat Red Hat OpenStack Platform 17.0
  • RDO OpenStack RDO

Classification

Weakness
  • CWE-202 Exposure of Sensitive Information Through Data Queries
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.