PT-2013-2186 · Openstack · Openstack Keystone

Dan Prince + 2 · Published 2013-02-24 · Updated 2018-11-15 · CVE-2013-0247

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions Essex 2012.1.3 and earlier OpenStack Keystone versions Folsom 2012.2.3 and earlier OpenStack Keystone versions Grizzly grizzly-2 and earlier

Description The issue allows remote attackers to cause a denial of service, specifically disk consumption, by sending many invalid token requests. This triggers the excessive generation of log entries.

Recommendations For OpenStack Keystone versions Essex 2012.1.3 and earlier, update to a version later than 2012.1.3 to resolve the issue. For OpenStack Keystone versions Folsom 2012.2.3 and earlier, update to a version later than 2012.2.3 to resolve the issue. For OpenStack Keystone versions Grizzly grizzly-2 and earlier, update to a version later than grizzly-2 to resolve the issue.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-0247

RHSA-2013:0253

Affected Products

Openstack Keystone

References · 10

• http://ubuntu.com/usn/USN-1715-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0247 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0247 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0253.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=906171 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0247 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0247 · Security Note
• https://bugs.launchpad.net/keystone/+bug/1098307 · Note
• http://securityfocus.com/bid/57747 · Note