CVE-2015-1852
OpenStack keystonemiddleware <1.6.0/python-keystoneclient <1.4.0 - ...
Title source: llmDescription
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
References (7)
Core 7
Core References
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2705-1
Vendor Advisory mailing-list
x_refsource_mlist
http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/keystonemiddleware/+bug/1411063
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1685.html
Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/74187
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1677.html
Scores
EPSS
0.0030
EPSS Percentile
53.4%
Details
CWE
CWE-17
Status
published
Products (6)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
15.04
openstack/keystonemiddleware
< 1.5.0
openstack/python-keystoneclient
< 1.3.0
pypi/keystonemiddleware
0 - 1.6.0PyPI
pypi/python-keystoneclient
0 - 1.4.0PyPI
Published
Apr 17, 2015
Tracked Since
Feb 18, 2026