Description (CNA)
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / OpenStack Folsom for RHEL 6 | unaffected 0:2012.2.3-7.el6ost before * |
| Red Hat / Red Hat OpenStack Platform 13 (Queens) | affected |
| Red Hat / Red Hat OpenStack Platform 16.2 | affected |
| Red Hat / Red Hat OpenStack Platform 16.2 | affected |
| Red Hat / Red Hat OpenStack Platform 17.1 | affected |
| Red Hat / Red Hat OpenStack Platform 17.1 | affected |
| Red Hat / Red Hat OpenStack Platform 18.0 | affected |
| Red Hat / Red Hat OpenStack Platform 18.0 | affected |
CWE
CWE-1284
References
- http://rhn.redhat.com/errata/RHSA-2013-0708.html
- https://access.redhat.com/errata/RHSA-2013:0708
- https://access.redhat.com/security/cve/CVE-2013-0270
- https://bugs.launchpad.net/keystone/+bug/1099025
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://launchpad.net/keystone/grizzly/2013.1
ADP enrichment
No English description supplied.
- https://launchpad.net/keystone/grizzly/2013.1
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://bugs.launchpad.net/keystone/+bug/1099025
- http://rhn.redhat.com/errata/RHSA-2013-0708.html