PT-2014-7804 · Openstack+1 · Openstack Keystonemiddleware+1

Qin Zhao · Published 2014-10-02 · Updated 2022-05-17 · CVE-2014-7144

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions 0.x through 0.10.x OpenStack keystonemiddleware versions 1.x through 1.1.x

Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure option is set in a paste.ini file, regardless of its value. This occurs because certification verification is disabled under these conditions.

Recommendations For OpenStack keystonemiddleware versions 0.x through 0.10.x, update to version 0.11.0 or later to resolve the issue. For OpenStack keystonemiddleware versions 1.x through 1.1.x, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider removing or modifying the insecure option in the paste.ini file to enable certification verification.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-310

Related Identifiers

CVE-2014-7144

GHSA-7F2C-VP52-GMFW

OPENSUSE-SU-2024:10471-1

PYSEC-2014-26

PYSEC-2014-71

RHSA-2014:1783

RHSA-2014:1784

RHSA-2015:0020

SUSE-SU-2015:1141-1

USN-2705-1

Affected Products

Openstack Keystonemiddleware

Ubuntu

References · 31

• https://ubuntu.com/security/CVE-2015-1852 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0020.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2705-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/09/25/51 · Patch
• https://osv.dev/vulnerability/CVE-2014-7144 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 · Security Note
• http://ubuntu.com/usn/USN-2705-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-7144 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f2c-vp52-gmfw · Vendor Advisory
• https://bugs.launchpad.net/python-keystoneclient/+bug/1353315 · Patch
• http://rhn.redhat.com/errata/RHSA-2014-1784.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-71 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1783.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-7144 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-7144 · Vendor Advisory