CVE-2013-0270
CVE-2013-0270 · Keystone: openstack keystone: denial of service via large http request with long tenant name
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
CVSS 6.5 · Medium · EPSS 3.2% · Fix available
- Published
- Updated
Affected products and versions
openstack folsom for rhel 6
- Versions
- ≥ 0:2012.2.3-7.el6ost: Not affected (rpm)
No fix published
red hat openstack platform 13 (queens)
No fix published
red hat openstack platform 16.2
No fix published
red hat openstack platform 17.1
No fix published
red hat openstack platform 18.0
No fix published
keystone Debian:12
- Affected ranges
- ECOSYSTEM: < 2013.1.1-2
Update to 2013.1.1-2
keystone Debian:13
- Affected ranges
- ECOSYSTEM: < 2013.1.1-2
Update to 2013.1.1-2
keystone Debian:14
- Affected ranges
- ECOSYSTEM: < 2013.1.1-2
Update to 2013.1.1-2
keystone PyPI
- Affected ranges
- ECOSYSTEM: < 8.0.0a0
Update to 8.0.0a0
Original sources
- http://rhn.redhat.com/errata/RHSA-2013-0708.html
- https://access.redhat.com/errata/RHSA-2013:0708
- https://access.redhat.com/security/cve/CVE-2013-0270
- https://bugs.launchpad.net/keystone/+bug/1099025
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://launchpad.net/keystone/grizzly/2013.1
- https://nvd.nist.gov/vuln/detail/CVE-2013-0270