GitHub Advisoryadvisory · PyPI

GHSA-6mv3-p2gr-wgqf OpenStack Identity (Keystone) DoS through V3 API authentication chaining

HIGH Published 2022-05-17 Modified 2025-04-13 Official page ↗
Aliases
CVE-2014-2828
Ecosystem
PyPI
Packages
keystone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287
Reviewed
2024-05-14

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

Related

Alias · CVE (1)

  • CVE-2014-2828 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References