CVE catalog
CVE-2023-1625
heat: CVE-2023-1625
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.71% · Oct 25, 2026
An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | heat | sid | 1:27.0.0-4 | fixed |
| Debian | heat | forky | 1:26.0.1-1 | fixed |
| Debian | heat | trixie | 1:24.0.0-2 | fixed |
| Debian | heat | bookworm | 1:19.0.0-3 | fixed |
| Ubuntu | heat | 22.04 | 1:17.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2021120816.fe8fba8c9-0ubuntu2 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2022011216.9af3af156-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2022011216.9af3af156-0ubuntu3 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.1+git2022030311.968969b99-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1.2 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.1-0ubuntu1.1 | fixed |
| Ubuntu | heat | 18.04 | 1:9.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.1-0ubuntu2 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.2-0ubuntu1.1 | fixed |
| Ubuntu | heat | 20.04 | 1:13.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b1~git2019121613.7b606461e-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b2~git2020021413.94bdcd8c9-0ubuntu2 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b3~git2020032414.d8354d908-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b3~git2020041012.2ef9f4bf3-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.1.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.2.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.2.0-0ubuntu1.1 | fixed |
| Ubuntu | heat | 16.04 | 1:5.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0~b2-0ubuntu2 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.0.0-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.1.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.1.1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.1.2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 16.04 | 1:6.1.2-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:9.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.0-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.1-0ubuntu2 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.2-0ubuntu1 | vulnerable |
| Ubuntu | heat | 18.04 | 1:10.0.2-0ubuntu1.1 | fixed |
| Ubuntu | heat | 20.04 | 1:13.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b1~git2019121613.7b606461e-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b2~git2020021413.94bdcd8c9-0ubuntu2 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b3~git2020032414.d8354d908-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0~b3~git2020041012.2ef9f4bf3-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.0.0-0ubuntu0.20.04.1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.1.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.2.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 20.04 | 1:14.2.0-0ubuntu1.1 | fixed |
| Ubuntu | heat | 22.04 | 1:17.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2021120816.fe8fba8c9-0ubuntu2 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2022011216.9af3af156-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.0+git2022011216.9af3af156-0ubuntu3 | vulnerable |
| Ubuntu | heat | 22.04 | 1:17.0.1+git2022030311.968969b99-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1.1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.0-0ubuntu1.2 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.1-0ubuntu1 | vulnerable |
| Ubuntu | heat | 22.04 | 1:18.0.1-0ubuntu1.1 | fixed |
| Suse | openstack-heat | hpe helion openstack 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | openstack-heat-doc | hpe helion openstack 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | python-Werkzeug | hpe helion openstack 8 | 0.12.2-3.6.2 | fixed |
| Suse | venv-openstack-designate | hpe helion openstack 8 | 5.0.3~dev7-12.45.1 | fixed |
| Suse | venv-openstack-heat | hpe helion openstack 8 | 9.0.8~dev22-12.51.1 | fixed |
| Suse | venv-openstack-magnum | hpe helion openstack 8 | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | fixed |
| Suse | venv-openstack-octavia | hpe helion openstack 8 | 1.0.6~dev3-12.47.1 | fixed |
| Suse | venv-openstack-sahara | hpe helion openstack 8 | 7.0.5~dev4-11.46.1 | fixed |
| Suse | openstack-heat | openstack cloud 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | openstack-heat-doc | openstack cloud 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | python-Werkzeug | openstack cloud 8 | 0.12.2-3.6.2 | fixed |
| Suse | venv-openstack-designate | openstack cloud 8 | 5.0.3~dev7-12.45.1 | fixed |
| Suse | venv-openstack-heat | openstack cloud 8 | 9.0.8~dev22-12.51.1 | fixed |
| Suse | venv-openstack-magnum | openstack cloud 8 | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | fixed |
| Suse | venv-openstack-octavia | openstack cloud 8 | 1.0.6~dev3-12.47.1 | fixed |
| Suse | venv-openstack-sahara | openstack cloud 8 | 7.0.5~dev4-11.46.1 | fixed |
| Suse | openstack-heat | openstack cloud crowbar 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | openstack-heat-doc | openstack cloud crowbar 8 | 9.0.8~dev22-3.30.3 | fixed |
| Suse | python-Werkzeug | openstack cloud crowbar 8 | 0.12.2-3.6.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | heat | source | sid | 1:19.0.0-2 | not yet assigned | Not reported | [1034186] |
| Debian | heat | source | forky | 1:19.0.0-2 | not yet assigned | Not reported | [1034186] |
| Debian | heat | source | trixie | 1:19.0.0-2 | not yet assigned | Not reported | [1034186] |
| Debian | heat | source | bookworm | 1:19.0.0-2 | not yet assigned | Not reported | [1034186] |
| Ubuntu | heat | deb | 22.04 | 1:18.0.1-0ubuntu1.1 | Not reported | USN-6293-1 | Not reported |
| Ubuntu | heat | deb | 18.04 | 1:10.0.2-0ubuntu1.1 | Not reported | USN-6066-1 | Not reported |
| Ubuntu | heat | deb | 20.04 | 1:14.2.0-0ubuntu1.1 | Not reported | USN-6066-1 | Not reported |
| Ubuntu | heat | deb | 18.04 | 1:10.0.2-0ubuntu1.1 | Not reported | UBUNTU-CVE-2023-1625 | Not reported |
| Ubuntu | heat | deb | 20.04 | 1:14.2.0-0ubuntu1.1 | Not reported | UBUNTU-CVE-2023-1625 | Not reported |
| Ubuntu | heat | deb | 22.04 | 1:18.0.1-0ubuntu1.1 | Not reported | UBUNTU-CVE-2023-1625 | Not reported |
| Suse | openstack-heat | rpm | hpe helion openstack 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | openstack-heat-doc | rpm | hpe helion openstack 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | python-Werkzeug | rpm | hpe helion openstack 8 | 0.12.2-3.6.2 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-designate | rpm | hpe helion openstack 8 | 5.0.3~dev7-12.45.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-heat | rpm | hpe helion openstack 8 | 9.0.8~dev22-12.51.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-magnum | rpm | hpe helion openstack 8 | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-octavia | rpm | hpe helion openstack 8 | 1.0.6~dev3-12.47.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-sahara | rpm | hpe helion openstack 8 | 7.0.5~dev4-11.46.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | openstack-heat | rpm | openstack cloud 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | openstack-heat-doc | rpm | openstack cloud 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | python-Werkzeug | rpm | openstack cloud 8 | 0.12.2-3.6.2 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-designate | rpm | openstack cloud 8 | 5.0.3~dev7-12.45.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-heat | rpm | openstack cloud 8 | 9.0.8~dev22-12.51.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-magnum | rpm | openstack cloud 8 | 5.0.2_5.0.2_5.0.2~dev31-11.46.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-octavia | rpm | openstack cloud 8 | 1.0.6~dev3-12.47.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | venv-openstack-sahara | rpm | openstack cloud 8 | 7.0.5~dev4-11.46.1 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | openstack-heat | rpm | openstack cloud crowbar 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | openstack-heat-doc | rpm | openstack cloud crowbar 8 | 9.0.8~dev22-3.30.3 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
| Suse | python-Werkzeug | rpm | openstack cloud crowbar 8 | 0.12.2-3.6.2 | Not reported | SUSE-SU-2023:2379-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_2378-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-1625]
- [https://osv.dev/vulnerability/SUSE-SU-2023:2379-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-1625]
- [https://osv.dev/vulnerability/USN-6066-1]
- [https://osv.dev/vulnerability/USN-6293-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-1625]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-1625.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2432.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]