[openstack-announce] [OSSA 2014-030] TLS cert verification option not honoured in paste configs (CVE-2014-7144)

Grant Murphy gmurphy at redhat.com
Thu Sep 25 22:29:43 UTC 2014

OpenStack Security Advisory: 2014-030
CVE: CVE-2014-7144
Date: September 25, 2014

Title: TLS cert verification option not honoured in paste configs
Reporter: Qin Zhao (IBM)
Products: keystonemiddleware, python-keystoneclient
Versions: versions up to 1.1.1 (keystonemiddleware),
          versions up to 0.10.1 (python-keystoneclient)

Qin Zhao from IBM reported a vulnerability in keystonemiddleware
(formerly shipped as python-keystoneclient). When the 'insecure' option
is set in a paste configuration file it is effectively ignored,
regardless of its value. As a result certificate verification will be
disabled, leaving TLS connections open to MITM attacks. All versions of
keystonemiddleware with TLS settings configured via a paste.ini file are
affected by this flaw.

keystonemiddleware fix:

python-keystoneclient fix:

These fixes are included in the keystonemiddleware 1.2.0 release
and in the python-keystoneclient 0.11.0 release.


Grant Murphy
OpenStack Vulnerability Management Team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 213 bytes
Desc: not available
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20140926/f33e89ce/attachment.pgp>

More information about the OpenStack-announce mailing list