Description
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | horizon | 2014.1.3-6 | — |
| Debian 13 | horizon | 2014.1.3-6 | — |
| Debian 12 | horizon | 2014.1.3-6 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | horizon | 1:2014.1.4-0ubuntu2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | openstack-dashboard +3 | 2014.1.4-1.el6ost | RHSA-2015:0845, RHSA-2015:0839 |
| Red Hat OpenStack 5 | python-django-openstack-auth | 1.1.5-4.el6ost | RHSA-2015:0845, RHSA-2015:0839 |
Advisories 2
- RHSA-2015:0839 Red Hat Security Advisory: python-django-horizon and python-django-openstack-auth update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2015:0845 Red Hat Security Advisory: python-django-horizon and python-django-openstack-auth update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- https://bugs.launchpad.net/horizon/+bug/1394370
- 61186 third-party-advisory
- RHSA-2015:0845 vendor-advisory
- [openstack-announce] 20141209 [OSSA 2014-040] Horizon denial of service attack through login page (CVE-2014-8124) mailing-list
- FEDORA-2014-17177 vendor-advisory
- RHSA-2015:0839 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- openSUSE-SU-2015:0078 vendor-advisory