GitHub Advisoryadvisory · PyPI

GHSA-p9wq-mjh8-q72m OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks

HIGH Published 2022-05-17 Modified 2024-09-27 Official page ↗
Aliases
CVE-2015-1852
Ecosystem
PyPI
Packages
keystonemiddleware, python-keystoneclient
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2023-02-08

Affected packages

• PyPI keystonemiddleware: < 1.6.0 → fixed in 1.6.0 • PyPI python-keystoneclient: < 1.4.0 → fixed in 1.4.0

Description

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

Related

Alias · CVE (1)

  • CVE-2015-1852 The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References