CVE Vulnerabilities

CVE-2014-2828

Improper Authentication

Published: Apr 15, 2014 | Modified: Nov 04, 2015
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.8 HIGH
AV:N/AC:L/Au:N/C:N/I:N/A:C
RedHat/V2
5 MODERATE
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V3
Ubuntu
MEDIUM

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka authentication chaining.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Keystone Openstack 2013.1 (including) 2013.1 (including)
Keystone Openstack 2013.1.1 (including) 2013.1.1 (including)
Keystone Openstack 2013.1.2 (including) 2013.1.2 (including)
Keystone Openstack 2013.1.3 (including) 2013.1.3 (including)
Keystone Openstack 2013.2 (including) 2013.2 (including)
Keystone Openstack 2013.2.1 (including) 2013.2.1 (including)
Keystone Openstack 2013.2.2 (including) 2013.2.2 (including)
Keystone Openstack 2013.2.3 (including) 2013.2.3 (including)
OpenStack 4 for RHEL 6 RedHat openstack-keystone-0:2013.2.4-1.el6ost *
Keystone Ubuntu quantal *
Keystone Ubuntu saucy *

Potential Mitigations

References