CVE-2014-7144: Medium severity openstack keystonemiddleware vulnerability
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Other sources
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7144?
CVE-2014-7144 is classified as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2014-7144?
To fix CVE-2014-7144, upgrade to keystonemiddleware version 1.2.0 or python-keystoneclient version 1.2.0 or higher.
What software is affected by CVE-2014-7144?
CVE-2014-7144 affects versions of OpenStack keystonemiddleware 0.x before 0.11.0 and 1.x before 1.2.0, as well as python-keystoneclient versions prior to 1.2.0.
What kind of attack does CVE-2014-7144 allow?
CVE-2014-7144 allows remote attackers to perform man-in-the-middle attacks due to disabled certificate verification.
What configuration option is related to CVE-2014-7144?
The 'insecure' option set in the paste configuration ('paste.ini') file is directly related to the vulnerability in CVE-2014-7144.