TLS Certificate Verification Bypass in OpenStack Keystonemiddleware
CVE-2014-7144

Currently unrated

Key Information:

Vendor
Openstack
Status
Keystonemiddleware
Python-keystoneclient
Vendor
CVE Published:
2 October 2014

Summary

The OpenStack Keystonemiddleware suffers from a vulnerability where certification verification can be disabled by setting the 'insecure' option in the paste configuration file. This allows remote attackers to potentially execute man-in-the-middle attacks by leveraging a crafted certificate, putting sensitive data at risk and compromising system integrity. It is crucial for users of affected versions to update and ensure proper TLS configurations.

References

http://rhn.redhat.com/errata/RHSA-2015-0020.html
vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2014/09/25/51
mailing-listx_refsource_MLIST
http://www.ubuntu.com/usn/USN-2705-1
vendor-advisoryx_refsource_UBUNTU

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.