CVE-2024-7319: openstack-heat may disclose sensitive information

August 2, 2024 (updated September 24, 2024)

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied.

References

access.redhat.com/security/cve/CVE-2024-7319
bugzilla.redhat.com/show_bug.cgi?id=2258810
github.com/advisories/GHSA-2fqr-cx7q-3ph8
github.com/openstack/heat
nvd.nist.gov/vuln/detail/CVE-2024-7319
storyboard.openstack.org/

Code Behaviors & Features

Detect and mitigate CVE-2024-7319 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →