Keystone: openstack keystone: denial of service via large http request with long tenant name
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 3.1%
probabilidad de explotación
3.1%top 13% de las CVE
explotación observada
noninguna fuente lo reporta
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Productos afectados
Red Hat · OpenStack Folsom for RHEL 6Red Hat · Red Hat OpenStack Platform 13 (Queens)Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat OpenStack Platform 17.1Red Hat · Red Hat OpenStack Platform 18.0Referencias
http://rhn.redhat.com/errata/RHSA-2013-0708.htmlhttps://access.redhat.com/errata/RHSA-2013:0708https://access.redhat.com/security/cve/CVE-2013-0270https://bugs.launchpad.net/keystone/+bug/1099025https://bugzilla.redhat.com/show_bug.cgi?id=909012https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdchttps://launchpad.net/keystone/grizzly/2013.1