CVE-2015-1852: OpenStack keystonemiddleware and python-keystoneclient Man-in-the-Middle Vulnerability
Summary
CVE-2015-1852: OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks. Affects keystonemiddleware versions < 1.6.0. Fixed in 1.6.0. How to fix ↓
Also tracked for
- python-keystoneclient · Debian:11
- python-keystoneclient · PyPI
The same CVE-2015-1852 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack keystonemiddleware and python-keystoneclient are Python packages used in OpenStack deployments. keystonemiddleware provides middleware components for the OpenStack Identity service, while python-keystoneclient is a client library for the OpenStack Identity service. These packages are responsible for authentication and authorization within an OpenStack environment.
Vulnerability Detail
The s3_token middleware in OpenStack keystonemiddleware before version 1.6.0 and python-keystoneclient before version 1.4.0 have a vulnerability that allows man-in-the-middle attacks. This vulnerability occurs when the "insecure" option is set in a paste configuration file (paste.ini). The certification verification is disabled regardless of the value of the "insecure" option. An attacker can exploit this vulnerability by crafting a certificate, allowing them to intercept and manipulate network traffic, potentially leading to unauthorized access or data tampering.
How To Fix
Latest published version: 13.0.1 as of 22 Oct 2026
pip install --upgrade "keystonemiddleware==13.0.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.0
This is the first release that contains the fix.
pip install --upgrade "keystonemiddleware==1.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround is to manually enable certification verification in the paste configuration file. Remove or set the "insecure" option to false. This ensures that certification verification is performed, mitigating the risk of man-in-the-middle attacks. Here is an example of the modified paste.ini file:
[filter:s3_token] auth_uri = https://keystone.example.com:5000/v2.0 auth_url = https://keystone.example.com:35357 insecure = false
Note that this workaround should be considered temporary, and upgrading to the fixed versions is still recommended.
Conclusion
The OpenStack keystonemiddleware and python-keystoneclient packages are vulnerable to a man-in-the-middle attack due to a configuration issue. Upgrading to the fixed versions or applying the provided workaround is crucial to mitigate the risk of unauthorized access and data tampering. Prompt action should be taken to ensure the security of OpenStack deployments.
See every vulnerability recorded for keystonemiddleware →
FAQ
This vulnerability allows an attacker to intercept and manipulate network traffic, potentially leading to unauthorized access or data tampering within an OpenStack environment.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using only the Pipfile.lock file as input.
There are currently no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk of potential attacks.
Yes, this vulnerability can be exploited remotely. An attacker can intercept network traffic between the affected OpenStack components and manipulate it to gain unauthorized access or tamper with data.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in addressing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for keystonemiddleware.
