PT-2015-5472 · Openstack+1 · Openstack Keystonemiddleware+2

Blk-U + 1 · Publicado 2015-04-17 · Atualizado 2024-06-15 · CVE-2015-1852

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions prior to 1.6.0 python-keystoneclient versions prior to 1.4.0

Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure option is set in a paste configuration file, regardless of its value. This is due to the s3 token middleware disabling certification verification.

Recommendations For OpenStack keystonemiddleware versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. For python-keystoneclient versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider removing the insecure option from the paste configuration file to prevent the disabling of certification verification.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

CWE-17

Identificadores relacionados

CVE-2015-1852

GHSA-P9WQ-MJH8-Q72M

OPENSUSE-SU-2024:10411-1

OPENSUSE-SU-2024:10471-1

PYSEC-2015-30

PYSEC-2015-31

RHSA-2015:1677

RHSA-2015:1685

SUSE-SU-2015:1141-1

SUSE-SU-2015:1208-1

SUSE-SU-2015:1434-1

SUSE-SU-2015:1602-1

USN-2705-1

Produtos afetados

Openstack Keystonemiddleware

Ubuntu

Python-Keystoneclient

Referências · 41

• https://github.com/pypa/advisory-database/tree/main/vulns/python-keystoneclient/PYSEC-2015-31.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2015-30.yaml · Nota
• https://bugzilla.suse.com/933758 · Nota
• https://ubuntu.com/security/CVE-2015-1852 · Aviso do Fabricante
• https://bugzilla.suse.com/928205 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1685.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2705-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p9wq-mjh8-q72m · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2705-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 · Nota de Segurança
• https://web.archive.org/web/20200228060649/http://securityfocus.com/bid/74187 · Nota
• https://cve.org/CVERecord?id=CVE-2015-1852 · Nota de Segurança
• https://suse.com/support/update/announcement/2015/suse-su-20151208-1 · Nota
• http://rhn.redhat.com/errata/RHSA-2015-1677.html · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10411-1 · Aviso do Fabricante