Denial of Service Vulnerability in Keystone Package - CVE-2013-0270
Summary
CVE-2013-0270: OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name whe... Affects keystone versions < 2013.1.1-2. Fixed in 2013.1.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an essential component of the OpenStack cloud computing platform, responsible for identity management and access control. It facilitates authentication and authorization for users and services within the OpenStack ecosystem. The vulnerability CVE-2013-0270 affects Keystone versions prior to 2013.1.1-2, allowing attackers to exploit the system through large HTTP requests, potentially leading to significant resource consumption.
Vulnerability Detail
CVE-2013-0270 is a denial of service vulnerability that allows remote attackers to consume excessive CPU and memory resources by sending large HTTP requests to the Keystone service. This can be achieved by manipulating parameters such as tenant_name when requesting a token. The vulnerability is particularly concerning as it can lead to service outages and degraded performance for legitimate users, impacting the overall reliability of the OpenStack environment.
How To Fix
Minimum fixed version
2013.1.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing rate limiting on the Keystone service to mitigate the impact of large HTTP requests. This can be done by configuring the web server or proxy in front of Keystone to limit the size of incoming requests.
Conclusion
CVE-2013-0270 presents a significant risk to users of the Keystone package, allowing for denial of service attacks through large HTTP requests. It is crucial to upgrade to the fixed version to ensure the security and reliability of your OpenStack environment. Additionally, consider implementing rate limiting as a temporary measure.
See every vulnerability recorded for keystone →
FAQ
CVE-2013-0270 is a vulnerability in the Keystone package that allows remote attackers to cause denial of service through large HTTP requests.
Keystone versions before 2013.1.1-2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service, causing significant CPU and memory consumption, which may result in service outages and degraded performance.
Yes, implementing rate limiting on the Keystone service can help mitigate the impact of large HTTP requests until an upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
