Skip to content
OpenAdvisories
High RHSA-2014:1688 2 CVEs

Red Hat Security Advisory: openstack-keystone security and bug fix update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 4 openstack:4::el6 openstack-keystone 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-keystone-doc 0:2013.2.4-1.el6ost
Red Hat · OpenStack 4 openstack:4::el6 python-keystone 0:2013.2.4-1.el6ost

Vulnerabilities 2

  • High 7.5
    CVE-2014-2828

    OpenStack Identity (Keystone) DoS through V3 API authentication chaining

    The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication c…

    keystone keystone Debian PyPI
  • Medium —
    CVE-2014-3621

    OpenStack Identity Keystone Exposure of Sensitive Information

    The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl en…

    keystone keystone keystone Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://wiki.openstack.org/wiki/ReleaseNotes/2013.2.4
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1082669
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1086211
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1099628
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1139937
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1146083
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1688.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-2828
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-2828
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-2828
  • report
    https://access.redhat.com/security/cve/CVE-2014-3621
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3621
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3621