Description
A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | OpenStack Folsom for RHEL 6 | — | — |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2013.1.1-2 | — |
| Debian 13 | keystone | 2013.1.1-2 | — |
| Debian 12 | keystone | 2013.1.1-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | python-keystone +2 | 2012.2.3-7.el6ost | RHSA-2013:0708 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | < 8.0.0a0 | 8.0.0a0 | GHSA-4ppj-4p4v-jf4p |
Advisories 1
- RHSA-2013:0708 Red Hat Security Advisory: openstack-keystone security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- http://rhn.redhat.com/errata/RHSA-2013-0708.html
- RHSA-2013:0708 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2013-0270 vdb-entry
- https://bugs.launchpad.net/keystone/+bug/1099025
- https://bugzilla.redhat.com/show_bug.cgi?id=909012
- https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
- https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
- https://launchpad.net/keystone/grizzly/2013.1