CVE-2015-1852

2015-04-1717:59:02

Debian Security Bug Tracker

security-tracker.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.004

Percentile

73.1%

JSON

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the “insecure” option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

OSVersionArchitecturePackageVersionFilename
Debian12allpython-keystoneclient< 1:1.3.0-2python-keystoneclient_1:1.3.0-2_all.deb
Debian11allpython-keystoneclient< 1:1.3.0-2python-keystoneclient_1:1.3.0-2_all.deb
Debian999allpython-keystoneclient< 1:1.3.0-2python-keystoneclient_1:1.3.0-2_all.deb
Debian13allpython-keystoneclient< 1:1.3.0-2python-keystoneclient_1:1.3.0-2_all.deb
Debian12allpython-keystonemiddleware< 1.5.0-2python-keystonemiddleware_1.5.0-2_all.deb
Debian11allpython-keystonemiddleware< 1.5.0-2python-keystonemiddleware_1.5.0-2_all.deb
Debian999allpython-keystonemiddleware< 1.5.0-2python-keystonemiddleware_1.5.0-2_all.deb
Debian13allpython-keystonemiddleware< 1.5.0-2python-keystonemiddleware_1.5.0-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	python-keystoneclient	< 1:1.3.0-2	python-keystoneclient_1:1.3.0-2_all.deb
Debian	11	all	python-keystoneclient	< 1:1.3.0-2	python-keystoneclient_1:1.3.0-2_all.deb
Debian	999	all	python-keystoneclient	< 1:1.3.0-2	python-keystoneclient_1:1.3.0-2_all.deb
Debian	13	all	python-keystoneclient	< 1:1.3.0-2	python-keystoneclient_1:1.3.0-2_all.deb
Debian	12	all	python-keystonemiddleware	< 1.5.0-2	python-keystonemiddleware_1.5.0-2_all.deb
Debian	11	all	python-keystonemiddleware	< 1.5.0-2	python-keystonemiddleware_1.5.0-2_all.deb
Debian	999	all	python-keystonemiddleware	< 1.5.0-2	python-keystonemiddleware_1.5.0-2_all.deb
Debian	13	all	python-keystonemiddleware	< 1.5.0-2	python-keystonemiddleware_1.5.0-2_all.deb