CVE-2024-7319

What it actually does

Incomplete patch for prior information disclosure allows sensitive stack data to leak when the stack abandon command is invoked with the hidden feature enabled.

Why it matters to the business

Organizations running OpenStack on Debian 12 face risk of unintended exposure of configuration or credential data, increasing chance of follow-on attacks or regulatory findings; low EPSS and no KEV listing reduce immediate urgency but the 800-day exposure window warrants review.

How an attack unfolds

An authenticated user issues the OpenStack stack abandon command against a stack that has the hidden flag set to True; because the CVE-2023-1625 remediation was incomplete, the command returns previously protected fields containing sensitive information.

How to fix it

Upgrade the affected linux package on Debian 12 to version 6.1.106-1; verify the openstack-heat component receives the complete fix for CVE-2023-1625 and test that stack abandon no longer discloses hidden data.

How to confirm the fix worked

Confirm package version is at or above 6.1.106-1, re-run the stack abandon command with hidden=True on a test stack, and verify that sensitive fields are no longer present in the output.

Typical attack path

1. Obtain valid OpenStack credentials with access to the target stack
2. Invoke the stack abandon command while supplying hidden=True
3. Capture the returned stack metadata containing sensitive values

How to detect it

Search OpenStack service and API logs for invocations of the stack abandon command that include the hidden parameter; review any resulting stack metadata exports for unexpected sensitive values.

What your security team should do

• Apply the 6.1.106-1 update across all Debian 12 systems hosting OpenStack within the next maintenance window
• Audit existing stacks for any that were abandoned with hidden=True and rotate any exposed secrets
• Add monitoring for stack abandon operations in OpenStack API logs