OpenStack Security Advisory: 2013-003

CVE: CVE-2013-0247
Date: February 5, 2013
Title: Keystone denial of service through invalid token requests
Reporter: Dan Prince (Red Hat)
Products: Keystone
Affects: All versions

Description:

Dan Prince of Red Hat reported a vulnerability in token creation error
handling in Keystone. By requesting lots of invalid tokens, an
unauthenticated user may fill up logs on Keystone API servers disks,
potentially resulting in a denial of service attack against Keystone.

Grizzly fix:

• GitHub Commit

Folsom fix:

• GitHub Commit

Essex fix:

• Review on OpenStack Gerrit

References:

• Launchpad Bug
• CVE at Mitre