CVE-2014-7144: OpenStack keystonemiddleware Certificate Verification Bypass
Summary
CVE-2014-7144: OpenStack keystonemiddleware does not verify certificate. Affects keystonemiddleware across 2 version ranges.
< 0.11.0
>= 1.0, < 1.2.0
Fixed in 0.11.0 or 1.2.0, depending on the release line you run. How to fix ↓
Also tracked for
- python-keystoneclient · Debian:11
- python-keystoneclient · PyPI
The same CVE-2014-7144 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack keystonemiddleware (formerly python-keystoneclient) is a Python library used for integrating OpenStack Identity service (Keystone) with other OpenStack services. It provides middleware components for authentication and authorization. This vulnerability affects versions 0.x before 0.11.0 and 1.x before 1.2.0 of keystonemiddleware. The vulnerability allows an attacker to conduct man-in-the-middle attacks by bypassing certificate verification when the "insecure" option is set in the paste configuration file.
Vulnerability Detail
The OpenStack keystonemiddleware vulnerability (CVE-2014-7144) arises from the improper handling of certificate verification. When the "insecure" option is enabled in the paste configuration file, the library disables certificate verification regardless of the value provided. This allows an attacker to present a crafted certificate during the SSL/TLS handshake, leading to a successful man-in-the-middle attack. By intercepting and modifying the communication between the client and the server, the attacker can eavesdrop, tamper with, or impersonate the parties involved.
How To Fix
Latest published version: 13.0.1 as of 22 Oct 2026
pip install --upgrade "keystonemiddleware==13.0.1"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.11.00.11.0pip install --upgrade "keystonemiddleware==0.11.0" -
>= 1.0, < 1.2.01.2.0pip install --upgrade "keystonemiddleware==1.2.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually modify the paste configuration file to enable certificate verification. This involves setting the "insecure" option to false. However, it is strongly advised to apply the recommended fix by upgrading to the fixed versions of keystonemiddleware.
Conclusion
The OpenStack keystonemiddleware vulnerability (CVE-2014-7144) allows for certificate verification bypass, enabling man-in-the-middle attacks. To mitigate this risk, it is crucial to upgrade to the fixed versions of keystonemiddleware (0.11.0 or later for version 0.x, and 1.2.0 or later for version 1.x). Additionally, users can manually enable certificate verification as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keystonemiddleware →
FAQ
Keystonemiddleware is a Python library used for integrating OpenStack Identity service (Keystone) with other OpenStack services. It provides middleware components for authentication and authorization.
This vulnerability allows an attacker to conduct man-in-the-middle attacks by bypassing certificate verification. By intercepting and modifying the communication between the client and the server, the attacker can eavesdrop, tamper with, or impersonate the parties involved.
To fix this vulnerability, it is recommended to upgrade to a fixed version of keystonemiddleware. Users of version 0.x should upgrade to version 0.11.0 or later, while users of version 1.x should upgrade to version 1.2.0 or later.
Yes, as a workaround, users can manually modify the paste configuration file to enable certificate verification by setting the "insecure" option to false. However, it is strongly advised to apply the recommended fix by upgrading to the fixed versions of keystonemiddleware.
You can find more information about this vulnerability in the official GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7f2c-vp52-gmfw/GHSA-7f2c-vp52-gmfw.json
Related vulnerabilities
Recent vulnerabilities recorded for keystonemiddleware.
