CVE-2013-0270

MediumCVSS 6.5/10Last modified Jul 30, 2026

Description

A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284 CWE-119

Affected software

Vendor	Product	Versions
Red Hat	OpenStack Folsom for RHEL 6	—
Red Hat	Red Hat OpenStack Platform 13 (Queens)	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 16.2	—
Red Hat	Red Hat OpenStack Platform 17.1	—
Red Hat	Red Hat OpenStack Platform 17.1	—
Red Hat	Red Hat OpenStack Platform 18.0	—
Red Hat	Red Hat OpenStack Platform 18.0	—

References

http://rhn.redhat.com/errata/RHSA-2013-0708.htmlThird Party Advisory
https://access.redhat.com/errata/RHSA-2013:0708
https://access.redhat.com/security/cve/CVE-2013-0270
https://bugs.launchpad.net/keystone/+bug/1099025Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=909012Third Party Advisory
https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8Third Party Advisory
https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdcThird Party Advisory
https://launchpad.net/keystone/grizzly/2013.1Patch, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0708.htmlThird Party Advisory
https://bugs.launchpad.net/keystone/+bug/1099025Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=909012Third Party Advisory
https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8Third Party Advisory
https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdcThird Party Advisory
https://launchpad.net/keystone/grizzly/2013.1Patch, Third Party Advisory

Timeline

Published: Apr 12, 2013
Last modified: Jul 30, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-02715.0The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mx CVE-2013-02726.8Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code v CVE-2013-02735.0sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remo CVE-2013-02742.9upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cau CVE-2013-02754.3Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTM CVE-2013-02764.3ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protect CVE-2013-027710.0ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary c CVE-2013-02814.3Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of CVE-2013-02825.0OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3)CVE-2013-02835.4Katello: Username in Notification page has cross site scripting CVE-2013-02845.0Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attacker CVE-2013-02857.5The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, whic