CVE-2012-1572
published 2019-11-12CVE-2012-1572: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
PriorityP434high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.20%
64.7th percentile
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | keystone | < keystone 2012.1~rc2-1 (bookworm) | keystone 2012.1~rc2-1 (bookworm) |
| keystone | keystone | — | — |
| openstack | keystone | >= 0 < 2012.1~rc2-1 | 2012.1~rc2-1 |
| openstack | keystone | >= 0 < 2012.1~rc2-1 | 2012.1~rc2-1 |
| openstack | keystone | >= 0 < 2012.1~rc2-1 | 2012.1~rc2-1 |
| openstack | keystone | >= 0 < 2012.1~rc2-1 | 2012.1~rc2-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6xjx-jphh-cf8v: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
ghsa_unreviewed·2022-05-24
CVE-2012-1572 [MEDIUM] GHSA-6xjx-jphh-cf8v: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
OSV
CVE-2012-1572: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
osv·2019-11-12·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572: OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Debian
CVE-2012-1572: keystone - OpenStack Keystone: extremely long passwords can crash Keystone by exhausting st...
vendor_debian·2012·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572: keystone - OpenStack Keystone: extremely long passwords can crash Keystone by exhausting st...
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Scope: local
bookworm: resolved (fixed in 2012.1~rc2-1)
bullseye: resolved (fixed in 2012.1~rc2-1)
forky: resolved (fixed in 2012.1~rc2-1)
sid: resolved (fixed in 2012.1~rc2-1)
trixie: resolved (fixed in 2012.1~rc2-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [epel-6]
bugzilla·2012-03-27·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [epel-6]
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [epel-6]
See CVE-2012-1572
Discussion:
openstack-keystone-2012.1-0.12.rc1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/openstack-keystone-2012.1-0.12.rc1.el6
---
Package openstack-keystone-2012.1-0.12.rc1.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing openstack-keystone-2012.1-0.12.rc1.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2012-0916/openstack-keystone-2012.1-0.12.rc1.el6
then log in and leave karma (feedback).
---
openstack
Bugzilla
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-16]
bugzilla·2012-03-27·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-16]
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-16]
See CVE-2012-1572
Discussion:
openstack-keystone-2011.3.1-3.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/openstack-keystone-2011.3.1-3.fc16
---
Package openstack-keystone-2011.3.1-3.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing openstack-keystone-2011.3.1-3.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-4960/openstack-keystone-2011.3.1-3.fc16
then log in and leave karma (feedback).
---
openstack-keystone-2011.3.1-3.fc16 h
Bugzilla
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-17]
bugzilla·2012-03-27·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-17]
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone [fedora-17]
+++ This bug was initially created as a clone of Bug #807336 +++
See CVE-2012-1572
Discussion:
openstack-keystone-2012.1-0.12.rc1.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/FEDORA-2012-4690/openstack-keystone-2012.1-0.12.rc1.fc17
---
openstack-keystone-2012.1-1.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
Bugzilla
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone
bugzilla·2012-03-21·CVSS 7.5
CVE-2012-1572 [HIGH] CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone
CVE-2012-1572 openstack-keystone: extremely long passwords can crash Keystone
A vulnerability in how Keystone handles extremely long passwords was discovered. When Keystone is validating a password, glibc allocated space on the stack for the entire password. If the password is long enough, stack space can be exhausted which will lead to a crash. A remote attacker could use this to cause a crash in Keystone by submitting a long password when attempting to log into an existing account; an attacker must know an existing account name to attempt the login with for this attack to be successful.
Discussion:
This flaw is embargoed until 20120327.
---
Created attachment 571739
preliminary patch to fix the flaw
---
Hi Vincent. Distro bugs have been created and block this one.
Corresponding up
2019-11-12
Published