CVE-2014-7144

MEDIUM5.9EPSS 0.64%

OpenStack keystonemiddleware does not verify certificate

Published: 5/17/2022Modified: 9/27/2024

Also known as:GHSA-7f2c-vp52-gmfwDEBIAN-CVE-2014-7144PYSEC-2014-26PYSEC-2014-71

Description

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (`paste.ini`) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Affected packages (6)

Debian/python-keystoneclientfrom 0, < 1:0.10.1-2
Debian/python-keystonemiddlewarefrom 0, < 1.0.0-3
PyPI/keystonemiddlewarefrom 0, < 0.11.0
PyPI/keystonemiddlewarefrom 0, < 0.11.0, >= 1.0, < 1.2.0
PyPI/python-keystoneclientfrom 0, < 0.11.0
PyPI/python-keystoneclientfrom 0, < 0.11.0, >= 1.0, < 1.2.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Affected packages (6)

CVSS scores

References (15)