VYPR
Get started
← All advisories
High severityNVD Advisory· Published Apr 15, 2014· Updated May 6, 2026

CVE-2014-2828

CVE-2014-2828

Description

The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
keystonePyPI
< 8.0.0a08.0.0a0

Affected products

8
  • OpenStack/Keystone8 versions
    cpe:2.3:a:openstack:keystone:2013.1:*:*:*:*:*:*:*+ 7 more
    • cpe:2.3:a:openstack:keystone:2013.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.2:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:keystone:2013.2.3:*:*:*:*:*:*:*

Patches

3
ef868ad92c00

Sanitizes authentication methods received in requests.

https://github.com/openstack/keystoneFlorent FlamentApr 1, 2014via ghsa
commit
2 files changed · +19 −1
  • keystone/auth/controllers.py+7 −1 modified
    @@ -241,7 +241,13 @@ def get_method_names(self):
         :returns: list of auth method names
 
         """
-        return self.auth['identity']['methods'] or []
+        # Sanitizes methods received in request's body
+        # Filters out duplicates, while keeping elements' order.
+        method_names = []
+        for method in self.auth['identity']['methods']:
+            if method not in method_names:
+                method_names.append(method)
+        return method_names
 
     def get_method_data(self, method):
         """Get the auth method payload.
  • keystone/tests/test_v3_auth.py+12 −0 modified
    @@ -83,6 +83,18 @@ def test_both_project_and_domain_in_scope(self):
                           None,
                           auth_data)
 
+    def test_get_method_names_duplicates(self):
+        auth_data = self.build_authentication_request(
+            token='test',
+            user_id='test',
+            password='test')['auth']
+        auth_data['identity']['methods'] = ['password', 'token',
+                                            'password', 'password']
+        context = None
+        auth_info = auth.controllers.AuthInfo.create(context, auth_data)
+        self.assertEqual(auth_info.get_method_names(),
+                         ['password', 'token'])
+
     def test_get_method_data_invalid_method(self):
         auth_data = self.build_authentication_request(
             user_id='test',
ce6cedb30c5c

Sanitizes authentication methods received in requests.

https://github.com/openstack/keystoneFlorent FlamentApr 1, 2014via ghsa
commit
2 files changed · +19 −1
  • keystone/auth/controllers.py+7 −1 modified
    @@ -241,7 +241,13 @@ def get_method_names(self):
         :returns: list of auth method names
 
         """
-        return self.auth['identity']['methods'] or []
+        # Sanitizes methods received in request's body
+        # Filters out duplicates, while keeping elements' order.
+        method_names = []
+        for method in self.auth['identity']['methods']:
+            if method not in method_names:
+                method_names.append(method)
+        return method_names
 
     def get_method_data(self, method):
         """Get the auth method payload.
  • keystone/tests/test_v3_auth.py+12 −0 modified
    @@ -84,6 +84,18 @@ def test_both_project_and_domain_in_scope(self):
                           None,
                           auth_data)
 
+    def test_get_method_names_duplicates(self):
+        auth_data = self.build_authentication_request(
+            token='test',
+            user_id='test',
+            password='test')['auth']
+        auth_data['identity']['methods'] = ['password', 'token',
+                                            'password', 'password']
+        context = None
+        auth_info = auth.controllers.AuthInfo.create(context, auth_data)
+        self.assertEqual(auth_info.get_method_names(),
+                         ['password', 'token'])
+
     def test_get_method_data_invalid_method(self):
         auth_data = self.build_authentication_request(
             user_id='test',
e364ba5b12de

Sanitizes authentication methods received in requests.

https://github.com/openstack/keystoneFlorent FlamentApr 1, 2014via ghsa
commit
2 files changed · +19 −1
  • keystone/auth/controllers.py+7 −1 modified
    @@ -225,7 +225,13 @@ def get_method_names(self):
         :returns: list of auth method names
 
         """
-        return self.auth['identity']['methods'] or []
+        # Sanitizes methods received in request's body
+        # Filters out duplicates, while keeping elements' order.
+        method_names = []
+        for method in self.auth['identity']['methods']:
+            if method not in method_names:
+                method_names.append(method)
+        return method_names
 
     def get_method_data(self, method):
         """Get the auth method payload.
  • keystone/tests/test_v3_auth.py+12 −0 modified
    @@ -81,6 +81,18 @@ def test_both_project_and_domain_in_scope(self):
                           None,
                           auth_data)
 
+    def test_get_method_names_duplicates(self):
+        auth_data = self.build_authentication_request(
+            token='test',
+            user_id='test',
+            password='test')['auth']
+        auth_data['identity']['methods'] = ['password', 'token',
+                                            'password', 'password']
+        context = None
+        auth_info = auth.controllers.AuthInfo(context, auth_data)
+        self.assertEqual(auth_info.get_method_names(),
+                         ['password', 'token'])
+
     def test_get_method_data_invalid_method(self):
         auth_data = self.build_authentication_request(
             user_id='test',

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.