GitHub Advisoryadvisory · PyPI

GHSA-7f2c-vp52-gmfw OpenStack keystonemiddleware does not verify certificate

HIGH Published 2022-05-17 Modified 2024-09-27 Official page ↗
Aliases
CVE-2014-7144
Ecosystem
PyPI
Packages
keystonemiddleware, python-keystoneclient
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2023-08-16

Affected packages

• PyPI keystonemiddleware: < 0.11.0 → fixed in 0.11.0 • PyPI keystonemiddleware: >= 1.0, < 1.2.0 → fixed in 1.2.0 • PyPI python-keystoneclient: < 0.11.0 → fixed in 0.11.0 • PyPI python-keystoneclient: >= 1.0, < 1.2.0 → fixed in 1.2.0

Description

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (`paste.ini`) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Related

Alias · CVE (1)

  • CVE-2014-7144 OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References