PT-2015-5472 · Openstack+1 · Openstack Keystonemiddleware+2

Blk-U + 1 · Published 2015-04-17 · Updated 2024-06-15 · CVE-2015-1852

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack keystonemiddleware versions prior to 1.6.0 python-keystoneclient versions prior to 1.4.0

Description The issue allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate when the insecure option is set in a paste configuration file, regardless of its value. This is due to the s3 token middleware disabling certification verification.

Recommendations For OpenStack keystonemiddleware versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. For python-keystoneclient versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider removing the insecure option from the paste configuration file to prevent the disabling of certification verification.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

CWE-17

Related Identifiers

CVE-2015-1852

GHSA-P9WQ-MJH8-Q72M

OPENSUSE-SU-2024:10411-1

OPENSUSE-SU-2024:10471-1

PYSEC-2015-30

PYSEC-2015-31

RHSA-2015:1677

RHSA-2015:1685

SUSE-SU-2015:1141-1

SUSE-SU-2015:1208-1

SUSE-SU-2015:1434-1

SUSE-SU-2015:1602-1

USN-2705-1

Affected Products

Openstack Keystonemiddleware

Ubuntu

Python-Keystoneclient

References · 41

• https://ubuntu.com/security/CVE-2015-1852 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1685.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2705-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9wq-mjh8-q72m · Vendor Advisory
• http://ubuntu.com/usn/USN-2705-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-1852 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1677.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10411-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1208-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-30 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2015-31 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1852 · Security Note
• http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2705-1 · Vendor Advisory