Auth bypass in Openstack Keystone

CVE-2014-2828

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

Vulnerability class: Broken Authentication

EPSS: 0.032 (86.6th percentile) — read the EPSS interpretation.

Affected products

Openstack Keystone — versions 2013.1, 2013.1.1, 2013.1.2
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
cve@mitre.org (mailing-list, x_refsource_MLIST)
cve@mitre.org (x_refsource_CONFIRM)