OpenStack Keystone Middleware Vulnerability in Python Keystoneclient and Keystonemiddleware
Summary
CVE-2015-1852: The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file... Affects python-keystoneclient versions < 1:1.3.0-2. Fixed in 1:1.3.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack is a widely used open-source cloud computing platform that provides infrastructure as a service (IaaS). The keystonemiddleware package is responsible for handling authentication and authorization in OpenStack, while the python-keystoneclient is a client library for interacting with the Keystone API. This vulnerability affects versions of these packages prior to specific fixed releases, exposing users to potential man-in-the-middle attacks due to improper certificate verification.
Vulnerability Detail
The s3_token middleware in OpenStack keystonemiddleware versions before 1.6.0 and python-keystoneclient versions before 1.4.0 disables certificate verification when the 'insecure' option is set in the paste configuration file (paste.ini). This flaw allows remote attackers to exploit the system by conducting man-in-the-middle attacks using crafted certificates, compromising the integrity and confidentiality of the data being transmitted.
How To Fix
Minimum fixed version
1:1.3.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keystoneclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid setting the 'insecure' option in the paste.ini configuration file. This will ensure that certificate verification remains enabled, reducing the risk of man-in-the-middle attacks until the packages can be upgraded.
Conclusion
The vulnerability in OpenStack's keystonemiddleware and python-keystoneclient poses significant risks due to improper certificate verification. Users are strongly advised to upgrade to the fixed versions to safeguard their applications against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python-keystoneclient →
FAQ
The vulnerability allows attackers to perform man-in-the-middle attacks, potentially compromising sensitive data transmitted between clients and the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions are keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0.
Yes, you can avoid using the 'insecure' option in your paste.ini configuration file to maintain certificate verification.
More information can be found in the CVE details and related security advisories, such as USN-2705-1.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
