GitHub Advisoryadvisory · PyPI

GHSA-4ppj-4p4v-jf4p OpenStack Keystone Denial of Service vulnerability via a large HTTP request

MEDIUM Published 2022-05-05 Modified 2026-04-07 Official page ↗
Aliases
CVE-2013-0270
Ecosystem
PyPI
Packages
keystone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-119, CWE-1284
Reviewed
2024-05-13

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.

Related

Alias · CVE (1)

  • CVE-2013-0270 A flaw was found in OpenStack Keystone. vulnerability

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References