GHSA-hm3x-jwwf-jpr9

Suggest an improvement
Source
https://github.com/advisories/GHSA-hm3x-jwwf-jpr9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-hm3x-jwwf-jpr9/GHSA-hm3x-jwwf-jpr9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hm3x-jwwf-jpr9
Aliases
Published
2022-03-24T00:00:17Z
Modified
2023-11-08T04:07:01.997904Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates
Details

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the www_authenticate_uri parameter (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. A patch is available on the master branch and anticipated to be part of version 11.6.1.

Database specific 
{
    "github_reviewed_at": "2022-03-31T20:43:24Z",
    "nvd_published_at": "2022-03-23T20:15:00Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-200",
        "CWE-668"
    ],
    "github_reviewed": true
}
References

Affected packages

PyPI / tripleo-heat-templates

Package

Name
tripleo-heat-templates
View open source insights on deps.dev
Purl
pkg:pypi/tripleo-heat-templates

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
11.6.1

Affected versions

0.*
0.5.6
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.8.10
0.8.11
0.8.12
0.8.13
0.8.14
2.*
2.0.0
2.1.0
2.2.0
5.*
5.0.0.0b1
5.0.0.0b2
5.0.0.0b3
5.0.0.0rc1
5.0.0.0rc2
5.0.0.0rc3
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.3.9
5.3.10
5.3.11
5.3.12
5.3.13
6.*
6.0.0.0b1
6.0.0.0b2
6.0.0.0rc1
6.0.0.0rc2
6.0.0
6.1.0
6.2.0
6.2.1
6.2.2
6.2.3
6.2.4
6.2.5
6.2.6
6.2.7
6.2.8
6.2.9
6.2.10
6.2.11
6.2.12
6.2.13
6.2.14
6.2.15
6.2.16
7.*
7.0.0.0b1
7.0.0.0b2
7.0.0.0b3
7.0.0.0rc1
7.0.0.0rc2
7.0.0
7.0.1
7.0.2
7.0.3
7.0.4
7.0.5
7.0.6
7.0.7
7.0.8
7.0.9
7.0.10
7.0.11
7.0.12
7.0.13
7.0.14
7.0.15
7.0.16
7.0.17
7.0.18
8.*
8.0.0.0b1
8.0.0.0b2
8.0.0.0b3
8.0.0.0rc1
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.0.7
8.1.0
8.2.0
8.3.0
8.3.1
8.4.0
8.4.1
9.*
9.0.0.0b1
9.0.0.0b2
9.0.0.0b3
9.0.0.0b4
9.0.0.0rc1
9.0.0.0rc2
9.0.0
9.1.0
9.2.0
9.3.0
9.4.0
9.4.1
10.*
10.0.0
10.1.0
10.2.0
10.3.0
10.4.0
10.5.0
10.6.0
10.6.1
10.6.2
11.*
11.0.0
11.1.0
11.2.0
11.3.0
11.3.1
11.4.0
11.5.0
11.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/03/GHSA-hm3x-jwwf-jpr9/GHSA-hm3x-jwwf-jpr9.json"
last_known_affected_version_range 
"<= 11.6.0"