PT-2014-4910 · Openstack · Openstack Identity

Abu Shohel Ahmed · Published 2014-04-15 · Updated 2022-05-17 · CVE-2014-2828

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2013.1 through 2013.2.3 OpenStack Identity (Keystone) versions icehouse through icehouse-rc1

Description The issue allows remote attackers to cause a denial of service, specifically CPU consumption, by sending a large number of the same authentication method in a request. This is related to "authentication chaining" in the V3 API.

Recommendations For OpenStack Identity (Keystone) versions 2013.1 through 2013.2.3, update to version 2013.2.4 or later. For OpenStack Identity (Keystone) versions icehouse through icehouse-rc1, update to icehouse-rc2 or later.

Fix

DoS

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-2828

GHSA-6MV3-P2GR-WGQF

PYSEC-2014-106

RHSA-2014:1688

Affected Products

Openstack Identity

References · 17

• https://osv.dev/vulnerability/GHSA-6mv3-p2gr-wgqf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2828 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1688.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2828 · Security Note
• https://ubuntu.com/security/CVE-2014-2828 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2828 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-2828 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-106 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-2828 · Security Note
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/ce6cedb30c5c4b4cf4db9380f09443de22414b39 · Note
• https://github.com/openstack/keystone/commit/e364ba5b12de8e4c11bd80bcca903f9615dcfc2e · Note
• https://github.com/openstack/keystone/commit/ef868ad92c00e23a4a5e9eb71e3e0bf5ae2fff0c · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-106.yaml · Note