CVE-2014-2828

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-15 · updated 2026-06-17
Weakness: CWE-287

Description

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

Affected products

OpenStack Keystone: 2013.1, 2013.1.1, 2013.1.2, 2013.1.3, 2013.2, 2013.2.1 (+2)

References

http://rhn.redhat.com/errata/RHSA-2014-1688.html
http://www.openwall.com/lists/oss-security/2014/04/10/20
https://bugs.launchpad.net/keystone/+bug/1300274
http://rhn.redhat.com/errata/RHSA-2014-1688.html
http://www.openwall.com/lists/oss-security/2014/04/10/20
https://bugs.launchpad.net/keystone/+bug/1300274

Get alerted when CVE-2014-2828 or the next vulnerability affects your stack