CVE-2014-8124 OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause....
MediumCVSS 5.0
EPSS 2.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/horizon(Debian:12) | < 2014.1.3-6 | 2014.1.3-6 |
| debian/horizon(Debian:13) | < 2014.1.3-6 | 2014.1.3-6 |
| debian/horizon(Debian:14) | < 2014.1.3-6 | 2014.1.3-6 |
| OpenStack horizon | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| OpenStack horizon | >= 2014.2.0, < 2014.2.1 | 2014.2.1 |
| fedoraproject fedora | = 21 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| oracle solaris | = 11.2 | No fix listed |
References
- Debian Security Tracker CVE-2014-8124 vendor-advisory
- FEDORA-2014-17177 third-party-advisory vendor-advisory
- [openstack-announce] 20141209 [OSSA 2014-040] Horizon denial of service attack through login page (CVE-2014-8124) mailing-list patch vendor-advisory
- openSUSE-SU-2015:0078 mailing-list third-party-advisory vendor-advisory
- RHSA-2015:0839 broken-link vendor-advisory
- RHSA-2015:0845 broken-link vendor-advisory
- 61186 third-party-advisory
- www.oracle.com third-party-advisory
- bugs.launchpad.net issue-tracking third-party-advisory
- bugs.debian.org issue-tracking