CVE-2014-7144

2014-10-0214:55:04

CWE-310

[email protected]

web.nvd.nist.gov

openstack

keystonemiddleware

certification verification

insecure option

paste.ini

man-in-the-middle attacks

cve-2014-7144

nvd

6.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

66.1%

JSON

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the “insecure” option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Affected configurations

NVD

Node

openstackkeystonemiddlewareMatch1.0.0

openstackkeystonemiddlewareMatch1.1.0

openstackkeystonemiddlewareMatch1.1.1

openstackpython-keystoneclientRange≤0.10.1

CPENameOperatorVersion
openstack:keystonemiddlewareopenstack keystonemiddlewareeq1.0.0
openstack:keystonemiddlewareopenstack keystonemiddlewareeq1.1.0
openstack:keystonemiddlewareopenstack keystonemiddlewareeq1.1.1
openstack:python-keystoneclientopenstack python-keystoneclientle0.10.1

CPE	Name	Operator	Version
openstack:keystonemiddleware	openstack keystonemiddleware	eq	1.0.0
openstack:keystonemiddleware	openstack keystonemiddleware	eq	1.1.0
openstack:keystonemiddleware	openstack keystonemiddleware	eq	1.1.1
openstack:python-keystoneclient	openstack python-keystoneclient	le	0.10.1