OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks

2022-05-1703:17:26

Google

osv.dev

0.004 Low

EPSS

Percentile

73.1%

JSON

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the “insecure” option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

CPENameOperatorVersion
python-keystoneclienteq0.10.1
python-keystoneclienteq0.2.2
keystonemiddlewareeq0
keystonemiddlewareeq1.5.0
python-keystoneclienteq0.8.0
python-keystoneclienteq0.1.1
python-keystoneclienteq0.2.3
python-keystoneclienteq0.9.0
keystonemiddlewareeq1.5.2
python-keystoneclienteq0.11.2

Name	Operator	Version
python-keystoneclient	eq	0.10.1
python-keystoneclient	eq	0.2.2
keystonemiddleware	eq	0
keystonemiddleware	eq	1.5.0
python-keystoneclient	eq	0.8.0
python-keystoneclient	eq	0.1.1
python-keystoneclient	eq	0.2.3
python-keystoneclient	eq	0.9.0
keystonemiddleware	eq	1.5.2
python-keystoneclient	eq	0.11.2