Keystone: openstack keystone: denial of service via large http request with long tenant name
Priority LOW 35CWE-1284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
Why it matters now
EPSS 0.03165 88th percentileScored 2026-11-07
Fix Partial keystone (PyPI): 8.0.0a0Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | OpenStack Folsom for RHEL 6 | — | 2012.2.3-7.el6ost | Patch available | CNA |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — | No fix listed | CNA |
| — | keystone (PyPI) | before 8.0.0a0 | 8.0.0a0 | Patch available | GHSA-4ppj-4p4v-jf4p |
- OpenStack Folsom for RHEL 6 VendorRed Hat Affected — Fixed in 2012.2.3-7.el6ost Patch available CNA
- Red Hat OpenStack Platform 13 (Queens) VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 16.2 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 17.1 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenStack Platform 18.0 VendorRed Hat Affected — Fixed in — No fix listed CNA
- keystone (PyPI) Vendor— Affected before 8.0.0a0 Fixed in 8.0.0a0 Patch available GHSA-4ppj-4p4v-jf4p
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* | 2012.1 – 2012.1.3; 2012.2 – 2012.2.4 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:keystone:2013.1:milestone1:*:*:*:*:*:* | 2013.1 milestone1 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:keystone:2013.1:milestone2:*:*:*:*:*:* | 2013.1 milestone2 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:keystone:2013.1:milestone3:*:*:*:*:*:* | 2013.1 milestone3 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* Versions 2012.1 – 2012.1.3; 2012.2 – 2012.2.4 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:keystone:2013.1:milestone1:*:*:*:*:*:* Versions 2013.1 milestone1 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:keystone:2013.1:milestone2:*:*:*:*:*:* Versions 2013.1 milestone2 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:keystone:2013.1:milestone3:*:*:*:*:*:* Versions 2013.1 milestone3 Vulnerable ·OpenStack
Remediation
- Fix · GHSA-4ppj-4p4v-jf4p keystone (PyPI) Fixed in 8.0.0a0 Advisory →
Red Hat 1 advisory
- RHSA-2013:0708 Released 2013-04-04 · Red Hat rating Moderateopenstack-keystone security and bug fix update
- OpenStack Folsom openstack-keystone-2012.2.3-7.el6ost, openstack-keystone-doc-2012.2.3-7.el6ost, python-keystone-2012.2.3-7.el6ost
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| OpenStack Folsom | Fixed | RHSA-2013:0708 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0270
- 2026-10-03 Alias added: GHSA-4ppj-4p4v-jf4p
References
Advisory 7
- http://rhn.redhat.com/errata/RHSA-2013-0708.html
- RHSA-2013:0708
- https://bugs.launchpad.net/keystone/+bug/1099025
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://nvd.nist.gov/vuln/detail/CVE-2013-0270
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2013-0270 · CVE Program
- CVE-2013-0270 · NVD
- FIRST EPSS
- GHSA-4ppj-4p4v-jf4p · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0270 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences