CVE-2012-1572

Advisory

It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). Reportedly, all versions are affected. See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1572
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1572
• https://security-tracker.debian.org/tracker/CVE-2012-1572