CVE-2014-3473

Publication date 9 July 2014

Last updated 24 July 2024

Ubuntu priority

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
horizon	14.04 LTS trusty	Fixed 1:2014.1.2-0ubuntu1
	13.10 saucy	Ignored end of life
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

mdeslaur

introduced by: https://review.openstack.org/gitweb?p=openstack/horizon.git;h=8914ed95

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
horizon	Upstream: https://review.openstack.org/#/c/105478/ Upstream: https://review.openstack.org/#/c/105477/ Upstream: https://review.openstack.org/#/c/105476/

References

Related Ubuntu Security Notices (USN)