=============================================================== OSSA-2015-007: S3Token TLS cert verification option not honored =============================================================== :Date: April 14, 2015 :CVE: CVE-2015-1852 Affects ~~~~~~~ - python-keystoneclient: versions through 1.3.0 - keystonemiddleware: versions through 1.5.0 Description ~~~~~~~~~~~ Brant Knudson from IBM reported a vulnerability in keystonemiddleware (formerly shipped as python-keystoneclient). When the 'insecure' option is set in a S3Token paste configuration file its value is effectively ignored and instead assumed to be true. As a result certificate verification will be disabled, leaving TLS connections open to MITM attacks. Note that it's unusual to explicitly add this option and then set it to false, so the impact of this bug is thought to be limited. All versions of s3_token middleware with TLS settings configured are affected by this flaw. Patches ~~~~~~~ - https://review.openstack.org/173378 (python-keystoneclient) (Icehouse) - https://review.openstack.org/173376 (keystonemiddleware) (Juno) - https://review.openstack.org/173377 (python-keystoneclient) (Juno) - https://review.openstack.org/173365 (keystonemiddleware) (Kilo) - https://review.openstack.org/173370 (python-keystoneclient) (Kilo) Credits ~~~~~~~ - Brant Knudson from IBM (CVE-2015-1852) References ~~~~~~~~~~ - https://launchpad.net/bugs/1411063 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852 Notes ~~~~~ - This fix will be included in keystonemiddleware 1.6.0 release and python-keystoneclient 1.4.0 release. -- Tristan Cacqueray OpenStack Vulnerability Management Team