CVE-2014-7144: OpenStack keystonemiddleware Insecure Certificate Verification
Summary
CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardl... Affects python-keystoneclient across 2 version ranges.
< 0.11.0
>= 1.0, < 1.2.0
Fixed in 0.11.0 or 1.2.0, depending on the release line you run. How to fix ↓
Also tracked for
- keystonemiddleware · PyPI
- python-keystoneclient · Debian:11
- keystonemiddleware · PyPI
The same CVE-2014-7144 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack keystonemiddleware (formerly python-keystoneclient) is a Python library used for authentication and authorization in OpenStack projects. It provides a client interface to the Keystone identity service, allowing users to authenticate and obtain tokens for accessing OpenStack services. This vulnerability affects versions 0.x before 0.11.0 and 1.x before 1.2.0 of the library. The library disables certification verification when the "insecure" option is set in a paste configuration file (paste.ini), regardless of the value. This can be exploited by remote attackers to conduct man-in-the-middle attacks by using a crafted certificate.
Vulnerability Detail
The vulnerability in OpenStack keystonemiddleware arises from the improper handling of the "insecure" option in the paste configuration file. When this option is enabled, the library does not verify the authenticity of SSL/TLS certificates, making it susceptible to man-in-the-middle attacks. An attacker can exploit this by presenting a crafted certificate, intercepting the communication between the client and the server, and potentially gaining unauthorized access or tampering with the data being transmitted.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "python-keystoneclient==6.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.11.00.11.0pip install --upgrade "python-keystoneclient==0.11.0" -
>= 1.0, < 1.2.01.2.0pip install --upgrade "python-keystoneclient==1.2.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by manually enabling certificate verification in the paste configuration file. This can be done by setting the "insecure" option to "False". However, it is strongly recommended to upgrade to the latest version as soon as possible to ensure proper security.
Conclusion
The OpenStack keystonemiddleware vulnerability (CVE-2014-7144) allows for man-in-the-middle attacks due to the improper handling of certificate verification. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the python-keystoneclient library. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
OpenStack keystonemiddleware is a Python library used for authentication and authorization in OpenStack projects. It provides a client interface to the Keystone identity service.
Versions 0.x before 0.11.0 and 1.x before 1.2.0 of python-keystoneclient are affected.
This vulnerability can be exploited by remote attackers who can intercept the communication between the client and the server by using a crafted certificate, potentially gaining unauthorized access or tampering with the data being transmitted.
The recommended fix is to upgrade to version 0.11.0 or later for the 0.x branch, and version 1.2.0 or later for the 1.x branch of the python-keystoneclient library.
Yes, a temporary workaround is to manually enable certificate verification in the paste configuration file by setting the "insecure" option to "False". However, upgrading to the latest fixed version is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
