CVE-2014-8124
Fixed in a distro release EPSS 3%
OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.
Products: openstack horizon, fedoraproject fedora, opensuse, oracle solaris
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | horizon | 2014.1.3-6 |
| Debian 13 | horizon | 2014.1.3-6 |
| Debian 14 | horizon | 2014.1.3-6 |
| Red Hat openstack 5 | openstack-dashboard | 0:2014.1.4-1.el6ost |
| Red Hat openstack 5 | openstack-dashboard | 0:2014.1.4-1.el7ost |
| Red Hat openstack 5 | openstack-dashboard-theme | 0:2014.1.4-1.el6ost |
| Red Hat openstack 5 | openstack-dashboard-theme | 0:2014.1.4-1.el7ost |
| Red Hat openstack 5 | python-django-horizon | 0:2014.1.4-1.el7ost |
| Red Hat openstack 5 | python-django-horizon | 0:2014.1.4-1.el6ost |
| Red Hat openstack 5 | python-django-horizon-doc | 0:2014.1.4-1.el7ost |
| Red Hat openstack 5 | python-django-horizon-doc | 0:2014.1.4-1.el6ost |
| Red Hat openstack 5 | python-django-openstack-auth | 0:1.1.5-4.el7ost |
| Red Hat openstack 5 | python-django-openstack-auth | 0:1.1.5-4.el6ost |
| Ubuntu 14.04 LTS | horizon | 1:2014.1.4-0ubuntu2 |