CVE-2012-1572

Advisory

In Keystone versions prior to 8.0.0, It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.
https://github.com/openstack/keystone/commit/239e4f64c2134338b32ffd6d42c0b6ff70cd040c

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1572
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1572
• https://security-tracker.debian.org/tracker/CVE-2012-1572