CVE-2013-0270

Published: 12 April 2013

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.

Notes

Keystone on 11.10 is a pre-release version and unusable with other
components such as nova and horizon
per upstream (and me), change is to intrusive for stable release
update and the upstream patch was rejected for Folsom and earlier. This is
more of a feature than a vulnerability.

Status

References

• https://www.cve.org/CVERecord?id=CVE-2013-0270
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/keystone/+bug/1099025
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0270