SUSE-SU-2023:2378-1: openstack-heat&distro=SUSE OpenStack Cloud 9 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2023:2378-1 is a vulnerability in openstack-heat&distro=SUSE OpenStack Cloud 9 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 05-06-2023
   PublishedVulnerability first disclosed.
2. 04-02-2026
   Last modifiedVulnerability information updated.

Description

Security update for openstack-heat, openstack-swift, python-Werkzeug This update for openstack-heat, openstack-swift, python-Werkzeug contains the following fixes: Security fixes included in this update: openstack-heat: - CVE-2023-1625: Fixed an issue where parameter values marked as 'hidden' would be shown in the stack's environment (bsc#1209774). openstack-swift: - CVE-2022-47950: Fixed a local file disclosure that could be triggered by an authenticated attacker by supplying a malicious XML (bnc#1207035). python-Werkzeug: - CVE-2023-25577: Fixed an unbounded resource usage when parsing multipart forms with many fields (bsc#1208283). Non security changes on this update: Changes in openstack-heat: - Honor 'hidden' parameter in 'stack environment show' command. (bsc#1209774, CVE-2023-1625) Changes in openstack-swift: - Prevent XXE injections in API. (bsc#1207035, CVE-2022-47950) Changes in python-Werkzeug; - Limit maximum number of multipart form parts. (bsc#1208283, CVE-2023-25577)

No weakness data has been published for this record.