id: PYSEC-2016-34
details: The TripleO Heat templates (tripleo-heat-templates) do not properly order
  the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb
  middleware in the swiftproxy pipeline when the staticweb middleware is enabled,
  which might allow remote attackers to obtain sensitive information from private
  containers via unspecified vectors.
affected:
- package:
    name: tripleo-heat-templates
    ecosystem: PyPI
    purl: pkg:pypi/tripleo-heat-templates
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.8.7
  versions:
  - 0.5.6
  - 0.6.0
  - 0.6.1
  - 0.6.2
  - 0.6.3
  - 0.6.4
  - 0.7.0
  - 0.7.1
  - 0.7.2
  - 0.7.3
  - 0.7.4
  - 0.7.5
  - 0.7.6
  - 0.7.7
  - 0.7.8
  - 0.7.9
  - 0.8.0
  - 0.8.1
  - 0.8.2
  - 0.8.3
  - 0.8.4
  - 0.8.5
  - 0.8.6
references:
- type: ADVISORY
  url: https://access.redhat.com/errata/RHSA-2015:1862
- type: WEB
  url: https://bugs.launchpad.net/tripleo/+bug/1494896
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1261697
- type: WEB
  url: https://launchpadlibrarian.net/217268516/CVE-2015-5271_puppet-swift.patch
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8936-44gw-7664
aliases:
- CVE-2015-5271
- GHSA-8936-44gw-7664
modified: "2021-08-27T03:22:48.421612Z"
published: "2016-04-15T17:59:00Z"