CVE-2014-7144

Advisory

Python-keystoneclient versions 0.11.0 and 1.2.0 include a fix for CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
http://www.openwall.com/lists/oss-security/2014/09/25/51
https://bugs.launchpad.net/python-keystoneclient/+bug/1353315
http://rhn.redhat.com/errata/RHSA-2014-1783.html
http://rhn.redhat.com/errata/RHSA-2014-1784.html
http://rhn.redhat.com/errata/RHSA-2015-0020.html
http://www.ubuntu.com/usn/USN-2705-1
http://www.securityfocus.com/bid/69864
http://secunia.com/advisories/62709

Affected package

Affected versions

Fixed versions

Vulnerability changelog

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.


MLIST:[oss-security] 20140926 [OSSA 2014-030] TLS cert verification option not honoured in paste configs (CVE-2014-7144): http://www.openwall.com/lists/oss-security/2014/09/25/51
CONFIRM:https://bugs.launchpad.net/python-keystoneclient/+bug/1353315: https://bugs.launchpad.net/python-keystoneclient/+bug/1353315
REDHAT:RHSA-2014:1783: http://rhn.redhat.com/errata/RHSA-2014-1783.html
REDHAT:RHSA-2014:1784: http://rhn.redhat.com/errata/RHSA-2014-1784.html
REDHAT:RHSA-2015:0020: http://rhn.redhat.com/errata/RHSA-2015-0020.html
UBUNTU:USN-2705-1: http://www.ubuntu.com/usn/USN-2705-1
BID:69864: http://www.securityfocus.com/bid/69864
SECUNIA:62709: http://secunia.com/advisories/62709

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144
• http://www.openwall.com/lists/oss-security/2014/09/25/51
• https://bugs.launchpad.net/python-keystoneclient/+bug/1353315
• http://rhn.redhat.com/errata/RHSA-2014-1783.html
• http://rhn.redhat.com/errata/RHSA-2014-1784.html
• http://secunia.com/advisories/62709
• http://rhn.redhat.com/errata/RHSA-2015-0020.html
• http://www.ubuntu.com/usn/USN-2705-1
• http://www.securityfocus.com/bid/69864