CVE-2015-5295: Buffer Overflow
The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5295?
CVE-2015-5295 has been classified as a denial of service vulnerability that can be exploited to consume memory.
How do I fix CVE-2015-5295?
To fix CVE-2015-5295, upgrade to OpenStack Orchestration API version 2015.1.3 or later, or 5.0.1 or later.
Who is affected by CVE-2015-5295?
CVE-2015-5295 affects users of OpenStack Orchestration API versions before 2015.1.3 and 5.0.1.
What types of systems are impacted by CVE-2015-5295?
Impacted systems include OpenStack Orchestration API, Red Hat OpenStack 7.0, Fedora 23, and Oracle Solaris 11.3.
Can CVE-2015-5295 lead to data exposure?
CVE-2015-5295 can be used by authenticated users to determine the existence of local files, which may pose a data exposure risk.