An incomplete fix for CVE-2023-1625 in openstack-heat was discovered. Some sensitive information may still be disclosed through openstack stack abandon command even with the hidden feature set to True and CVE-2023-1625 fix applied.

References:

https://storyboard.openstack.org/#!/story/2011007

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nwproto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

A barbican configuration file is set to world-readable in Red Hat OpenStack. This presents a security risk as it allows authenticated attacker with limited access to the file to view its contents, including secure credential.

A container isolation flaw was discovered in Red Hat OpenStack, allowing an attacker with limited authentication and access to Barbican containers to potentially access other OpenStack containers and services. This is possible as they share common CGROUP and namespace.

An information leak was discovered in openstack heat. https://review.opendev.org/c/openstack/heat/+/868166 https://github.com/openstack/heat/commit/a49526c278e52823080c7f3fcb72785b93fd4dcb

The get stack environment API doesn't mask hidden parameter values. A malicious system user can get sensitive data by this API even though encryptparametersandproperties option is set to true. All VMs deployed by this heat template may be compromised.