CVE-2015-1852

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

These are all security issues fixed in the python-keystonemiddleware-4.9.0-1.3 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-keystoneclient-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

python-keystoneclient was updated to fix two security issues:

* bsc#928205: S3Token TLS certificate verification option not honored.
  (CVE-2015-1852)
* bsc#897103: TLS certificate verification option not honored in paste
  configs. (CVE-2014-7144)

Security Issues:

* CVE-2014-7144
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144>
* CVE-2015-1852
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852>

The python-keystoneclient was updated to fix one security issues.

The following vulnerability was fixed:

• bsc#928205: S3Token TLS cert verification option not honored (CVE-2015-1852)

This update provides the following fixes for various python-modules:

• python-openstackclient:

  • Fix image create location attribute (bnc#932270)

• python-novaclient:

  • Update novaclient shell to use shared arguments from Session
  • Support using the Keystone V3 API from the Nova CLI

• python-keystoneclient:

  • Fix s3_token middleware parsing insecure option (bsc#928205, CVE-2015-1852)

• python-glanceclient:

  • remove deprecation warning

This update for several python modules provides the following security fix and improvements.

• python-keystonemiddleware:

  • Fix s3_token middleware parsing insecure option (bsc#928205, CVE-2015-1852)

• python-novaclient:

  • Update novaclient shell to use shared arguments from Session (bnc#933758)
  • Support using the Keystone V3 API from the Nova CLI (bnc#933758)

• python-swiftclient:

  • Add dependency to python-setuptools (bnc#914910)

• python-glanceclient:

  • Remove deprecation warning

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

Qin Zhao discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

Brant Knudson discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)