PT-2014-4910 · Openstack · Openstack Identity

Abu Shohel Ahmed · Publicado 2014-04-15 · Atualizado 2022-05-17 · CVE-2014-2828

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2013.1 through 2013.2.3 OpenStack Identity (Keystone) versions icehouse through icehouse-rc1

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending a large number of the same authentication method in a request. This is related to "authentication chaining" in the V3 API.

Recommendations For OpenStack Identity (Keystone) versions 2013.1 through 2013.2.3, update to version 2013.2.4 or later. For OpenStack Identity (Keystone) versions icehouse through icehouse-rc1, update to icehouse-rc2 or later.

Correção

DoS

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2014-2828

GHSA-6MV3-P2GR-WGQF

PYSEC-2014-106

RHSA-2014:1688

Produtos afetados

Openstack Identity

Referências · 17

• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/ce6cedb30c5c4b4cf4db9380f09443de22414b39 · Nota
• https://github.com/openstack/keystone/commit/e364ba5b12de8e4c11bd80bcca903f9615dcfc2e · Nota
• https://github.com/openstack/keystone/commit/ef868ad92c00e23a4a5e9eb71e3e0bf5ae2fff0c · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-106.yaml · Nota
• https://osv.dev/vulnerability/GHSA-6mv3-p2gr-wgqf · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-2828 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1688.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/04/10/20 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2828 · Nota de Segurança
• https://ubuntu.com/security/CVE-2014-2828 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2828 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2828 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-2828 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-106 · Aviso do Fabricante