CVE-2015-5295

MEDIUM

OpenStack Orchestration API - DoS

Title source: llm

Description

The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.

References (6)

Scores

CVSS v3 5.4
EPSS 0.0164
EPSS Percentile 81.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Classification

CWE
CWE-119
Status draft

Affected Products (4)

openstack/orchestration_api < 5.0.1
redhat/openstack
fedoraproject/fedora
oracle/solaris

Timeline

Published Jan 20, 2016
Tracked Since Feb 18, 2026