OpenStack keystonemiddleware Vulnerability: Insecure Certificate Verification
Summary
CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardl... Affects python-keystoneclient versions < 1:0.10.1-2. Fixed in 1:0.10.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack keystonemiddleware, formerly known as python-keystoneclient, is a middleware component that provides authentication services for OpenStack applications. It enables secure access to OpenStack services by managing tokens and credentials. However, certain versions of this package are vulnerable to a critical issue where certificate verification can be disabled, exposing users to potential man-in-the-middle attacks.
Vulnerability Detail
The vulnerability identified as CVE-2014-7144 affects OpenStack keystonemiddleware versions 0.x before 0.11.0 and 1.x before 1.2.0. When the 'insecure' option is set in the paste configuration file (paste.ini), the middleware disables certificate verification regardless of the actual value. This flaw allows remote attackers to intercept and manipulate communications between clients and servers, leading to unauthorized access and data breaches.
How To Fix
Minimum fixed version
1:0.10.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keystoneclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid setting the 'insecure' option in the paste.ini file. This will ensure that certificate verification remains enabled, thus mitigating the risk of man-in-the-middle attacks. However, this is not a permanent solution, and upgrading the packages is strongly recommended.
Conclusion
The CVE-2014-7144 vulnerability in OpenStack keystonemiddleware poses significant security risks by allowing the disabling of certificate verification. It is crucial for users to upgrade to the fixed versions and ensure proper configuration to safeguard against potential attacks.
See every vulnerability recorded for python-keystoneclient →
FAQ
CVE-2014-7144 is a vulnerability in OpenStack keystonemiddleware that allows attackers to disable certificate verification, leading to potential man-in-the-middle attacks.
Affected versions include OpenStack keystonemiddleware 0.x before 0.11.0 and 1.x before 1.2.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If immediate upgrading is not possible, ensure that the 'insecure' option is not set in your paste.ini file to maintain certificate verification.
Failing to address this vulnerability can lead to unauthorized access, data breaches, and compromise of sensitive information due to man-in-the-middle attacks.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
