PT-2014-7804 · Openstack+1 · Openstack Keystonemiddleware+1

Qin Zhao · Publicado 2014-10-02 · Atualizado 2022-05-17 · CVE-2014-7144

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions 0.x through 0.10.x OpenStack keystonemiddleware versions 1.x through 1.1.x

Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure option is set in a paste.ini file, regardless of its value. This occurs because certification verification is disabled under these conditions.

Recommendations For OpenStack keystonemiddleware versions 0.x through 0.10.x, update to version 0.11.0 or later to resolve the issue. For OpenStack keystonemiddleware versions 1.x through 1.1.x, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider removing or modifying the insecure option in the paste.ini file to enable certification verification.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-310

Identificadores relacionados

CVE-2014-7144

GHSA-7F2C-VP52-GMFW

OPENSUSE-SU-2024:10471-1

PYSEC-2014-26

PYSEC-2014-71

RHSA-2014:1783

RHSA-2014:1784

RHSA-2015:0020

SUSE-SU-2015:1141-1

USN-2705-1

Produtos afetados

Openstack Keystonemiddleware

Ubuntu

Referências · 31

• https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2014-71.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2014-26.yaml · Nota
• https://github.com/openstack/ossa/blob/23e15de721f4a6890374a231d93524e02965a97f/ossa/OSSA-2014-030.yaml · Nota
• https://ubuntu.com/security/CVE-2015-1852 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-0020.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2705-1 · Aviso do Fabricante
• https://web.archive.org/web/20200228053850/http://securityfocus.com/bid/69864 · Nota
• http://openwall.com/lists/oss-security/2014/09/25/51 · Correção
• http://lists.openstack.org/pipermail/openstack-announce/2014-September/000281.html · Nota
• https://osv.dev/vulnerability/CVE-2014-7144 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 · Nota de Segurança
• http://ubuntu.com/usn/USN-2705-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7144 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7f2c-vp52-gmfw · Aviso do Fabricante
• https://bugs.launchpad.net/python-keystoneclient/+bug/1353315 · Correção