TLS Certificate Verification Bypass in OpenStack Keystonemiddleware
CVE-2014-7144

Currently unrated

Key Information:

Vendor: Openstack
Status: Keystonemiddleware; Python-keystoneclient
Vendor: CVE Published:; 2 October 2014

Summary

The OpenStack Keystonemiddleware suffers from a vulnerability where certification verification can be disabled by setting the 'insecure' option in the paste configuration file. This allows remote attackers to potentially execute man-in-the-middle attacks by leveraging a crafted certificate, putting sensitive data at risk and compromising system integrity. It is crucial for users of affected versions to update and ensure proper TLS configurations.

References

http://rhn.redhat.com/errata/RHSA-2015-0020.html

vendor-advisoryx_refsource_REDHAT

http://www.openwall.com/lists/oss-security/2014/09/25/51

mailing-listx_refsource_MLIST

http://www.ubuntu.com/usn/USN-2705-1

vendor-advisoryx_refsource_UBUNTU

Timeline

Vulnerability published
Oct 2, 2014
Vulnerability Reserved
Sep 22, 2014