Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wOXdxLW1qaDgtcTcybc4AAcZh
OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
Permalink: https://github.com/advisories/GHSA-p9wq-mjh8-q72mJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOXdxLW1qaDgtcTcybc4AAcZh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
Identifiers: GHSA-p9wq-mjh8-q72m, CVE-2015-1852
References:
- https://nvd.nist.gov/vuln/detail/CVE-2015-1852
- https://bugs.launchpad.net/keystonemiddleware/+bug/1411063
- http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html
- http://rhn.redhat.com/errata/RHSA-2015-1677.html
- http://rhn.redhat.com/errata/RHSA-2015-1685.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.ubuntu.com/usn/USN-2705-1
- https://access.redhat.com/errata/RHSA-2015:1677
- https://access.redhat.com/errata/RHSA-2015:1685
- https://access.redhat.com/security/cve/CVE-2015-1852
- https://bugzilla.redhat.com/show_bug.cgi?id=1209527
- https://web.archive.org/web/20200228060649/http://www.securityfocus.com/bid/74187
- http://www.securityfocus.com/bid/74187
- https://github.com/advisories/GHSA-p9wq-mjh8-q72m
Affected Packages
pypi:python-keystoneclient
Dependent packages: 119Dependent repositories: 3,159
Downloads: 535,622 last month
Affected Version Ranges: < 1.4.0
Fixed in: 1.4.0
All affected versions: 0.1.1, 0.1.2, 0.1.3, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.3.0, 0.3.1, 0.3.2, 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.6.0, 0.7.0, 0.7.1, 0.8.0, 0.9.0, 0.10.0, 0.10.1, 0.11.0, 0.11.1, 0.11.2, 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4
All unaffected versions: 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.8.0, 1.8.1, 2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.4.0, 3.5.0, 3.5.1, 3.6.0, 3.7.0, 3.8.0, 3.9.0, 3.10.0, 3.11.0, 3.12.0, 3.13.0, 3.13.1, 3.14.0, 3.15.0, 3.15.1, 3.16.0, 3.17.0, 3.18.0, 3.19.0, 3.19.1, 3.20.0, 3.21.0, 3.22.0, 4.0.0, 4.1.0, 4.1.1, 4.2.0, 4.3.0, 4.4.0, 4.5.0, 5.0.0, 5.0.1, 5.1.0, 5.2.0, 5.3.0, 5.4.0
pypi:keystonemiddleware
Dependent packages: 49Dependent repositories: 411
Downloads: 91,927 last month
Affected Version Ranges: < 1.6.0
Fixed in: 1.6.0
All affected versions: 1.0.0, 1.1.0, 1.1.1, 1.2.0, 1.3.0, 1.3.1, 1.3.2, 1.4.0, 1.5.0, 1.5.1, 1.5.2, 1.5.3
All unaffected versions: 1.6.0, 1.6.1, 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.4.0, 2.4.1, 3.0.0, 4.0.0, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.4.1, 4.5.0, 4.5.1, 4.6.0, 4.7.0, 4.8.0, 4.9.0, 4.9.1, 4.10.0, 4.11.0, 4.12.0, 4.13.0, 4.13.1, 4.14.0, 4.15.0, 4.16.0, 4.17.0, 4.17.1, 4.18.0, 4.19.0, 4.20.0, 4.21.0, 4.22.0, 5.0.0, 5.1.0, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 6.0.0, 6.0.1, 6.1.0, 7.0.0, 7.0.1, 8.0.0, 9.0.0, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 10.0.0, 10.0.1, 10.1.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.4.1, 10.5.0, 10.6.0