Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

OpenStack Keystone V3 API: CPU Overload via Malicious Login Attempts

CVE-2014-2828 · published 12 years ago
Summary

A flaw in the OpenStack Keystone V3 API allows hackers to flood the system with fake login requests, causing it to become slow or unresponsive. This could impact the performance of your cloud infrastructure. To fix this issue, update your OpenStack Keystone to version 2013.2.4 or later, or icehouse-rc2 or later.

What to do
  • Update openstack keystone to version 8.0.0a0.
Affected software
Ecosystem VendorProductAffected versions
pip openstack keystone < 8.0.0a0
Fix: upgrade to 8.0.0a0
– openstack keystone 2013.1
2013.1.1
2013.1.2
2013.1.3
2013.2
2013.2.1
2013.2.2
2013.2.3
cpe:2.3:a:openstack:keystone:2013.1:*:*:*:*:*:*:*
Original advisory text
The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the ...
The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.7 High
Exploitation
3% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published15 Apr 2014
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-6mv3-p2gr-wgqf · GHSA
CVE-2014-2828 · NVD
Track software like this
Free during beta