CVE-2015-5303: PYSEC-2016-35 - The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack

CVE-2015-5303 · Severity: low · CVSS 3 · Published 2016-04-11

Technologies: tripleo-heat-templates (PyPI). Vendors: PyPI.

Executive brief

The TripleO Heat templates (tripleo-heat-templates), when deployed via the commandline interface, allow remote attackers to spoof OpenStack Networking metadata requests by leveraging knowledge of the default value of the NeutronMetadataProxySharedSecret parameter.

Affected products

PyPI tripleo-heat-templates

Related threats

PYSEC-2026-754 - Openstack tripleo-heat-templates unauthenticated file access
PYSEC-2026-753 - Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates
PYSEC-2018-102 - A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configurat
PYSEC-2016-34 - The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storag