Every CVE Search/ Get API key

CVE-2014-7144

OpenStack keystonemiddleware does not verify certificate

4.3 MediumFix available

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Exploit likelihood

1.90%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
CVE-2014-7144
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-310
Updated
2026-11-02
CVE List No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
CVE-2014-7144
Updated
2026-11-02
EUVDEUVD-2014-0030 No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
EUVD-2014-0030
Updated
2026-11-03
GitHub AdvisoriesGHSA-7f2c-vp52-gmfw 8.2

OpenStack keystonemiddleware does not verify certificate

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
GHSA-7f2c-vp52-gmfw
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSVGHSA-7f2c-vp52-gmfw 8.2

OpenStack keystonemiddleware does not verify certificate

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
GHSA-7f2c-vp52-gmfw
CVSS 4.0
8.2 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.9 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-295
Updated
2026-11-02
OSV No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
CVE-2014-7144
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2014-7144 No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
DEBIAN-CVE-2014-7144
Updated
2026-11-02
OSVopenSUSE-SU-2024:10471-1 No score

python-keystoneclient-3.5.0-1.1 on GA media

These are all security issues fixed in the python-keystoneclient-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10471-1
Updated
2026-11-02
OSVPYSEC-2014-26 No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
PYSEC-2014-26
Updated
2026-11-02
OSVPYSEC-2014-71 No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
PYSEC-2014-71
Updated
2026-11-02
OSVSUSE-SU-2015:1141-1 No score

Security update for python-keystoneclient

python-keystoneclient was updated to fix two security issues:

* bsc#928205: S3Token TLS certificate verification option not honored.
  (CVE-2015-1852)
* bsc#897103: TLS certificate verification option not honored in paste
  configs. (CVE-2014-7144)

Security Issues:

* CVE-2014-7144
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7144>
* CVE-2015-1852
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852>
Record
SUSE-SU-2015:1141-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-7144 No score

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Record
UBUNTU-CVE-2014-7144
Updated
2026-11-02
OSVUSN-2705-1 No score

python-keystoneclient, python-keystonemiddleware vulnerabilities

Qin Zhao discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

Brant Knudson discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)

Record
USN-2705-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystonemiddleware
PyPI
 before 0.11.0
0.11.0
keystonemiddleware
PyPI
 1.0 up to 1.2.0
1.2.0
python-keystoneclient
PyPI
 before 0.11.0
0.11.0
python-keystoneclient
PyPI
 1.0 up to 1.2.0
1.2.0
python-keystoneclient
Debian:12
 before 1:0.10.1-2
1:0.10.1-2
python-keystoneclient
Debian:13
 before 1:0.10.1-2
1:0.10.1-2
python-keystoneclient
Debian:14
 before 1:0.10.1-2
1:0.10.1-2
python-keystonemiddleware
Debian:12
 before 1.0.0-3
1.0.0-3
python-keystonemiddleware
Debian:13
 before 1.0.0-3
1.0.0-3
python-keystonemiddleware
Debian:14
 before 1.0.0-3
1.0.0-3
Show 13 moreShow less
Affected packages
PackageAffectedFixed
keystonemiddleware
PyPI
 1.0 up to 1.2.0, plus listed versions
1.0.01.1.01.1.1
1.2.0
python-keystoneclient
PyPI
 before 0.11.0, plus listed versions
0.1.10.1.20.1.30.10.00.10.1
Show 19 moreShow less
0.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.10.3.20.4.00.4.10.4.20.5.00.5.10.6.00.7.00.7.10.8.00.9.0
0.11.0
python-keystoneclient
PyPI
 1.0 up to 1.2.0, plus listed versions
1.0.01.1.01.1.1
1.2.0
keystonemiddleware
PyPI
 before 0.11.0, 1.0 up to 1.2.0, plus listed versions
1.0.01.1.01.1.1
0.11.01.2.0
python-keystoneclient
PyPI
 before 0.11.0, 1.0 up to 1.2.0, plus listed versions
0.1.10.1.20.1.30.10.00.10.1
Show 22 moreShow less
0.2.00.2.10.2.20.2.30.2.40.2.50.3.00.3.10.3.20.4.00.4.10.4.20.5.00.5.10.6.00.7.00.7.10.8.00.9.01.0.01.1.01.1.1
0.11.01.2.0
python-keystoneclient
Red Hat:openstack:5::el6
 before 1:0.9.0-5.el6ost
1:0.9.0-5.el6ost
python-keystoneclient-doc
Red Hat:openstack:5::el6
 before 1:0.9.0-5.el6ost
1:0.9.0-5.el6ost
python-keystoneclient
Red Hat:openstack:5::el7
 before 1:0.9.0-5.el7ost
1:0.9.0-5.el7ost
python-keystoneclient-doc
Red Hat:openstack:5::el7
 before 1:0.9.0-5.el7ost
1:0.9.0-5.el7ost
python-keystoneclient
Red Hat:openstack:4::el6
 before 1:0.7.1-5.el6ost
1:0.7.1-5.el6ost
python-keystoneclient-doc
Red Hat:openstack:4::el6
 before 1:0.7.1-5.el6ost
1:0.7.1-5.el6ost
python-keystoneclient
Ubuntu:14.04:LTS
 before 1:0.7.1-ubuntu1.2, plus listed versions
1:0.3.2-0ubuntu11:0.4.1-0ubuntu11:0.4.2-0ubuntu11:0.6.0-0ubuntu11:0.7.1-ubuntu1
1:0.7.1-ubuntu1.2
python-keystoneclient
Ubuntu:14.04:LTS
From an advisory covering 2 CVEs
 before 1:0.7.1-ubuntu1.2, plus listed versions
1:0.3.2-0ubuntu11:0.4.1-0ubuntu11:0.4.2-0ubuntu11:0.6.0-0ubuntu11:0.7.1-ubuntu1
1:0.7.1-ubuntu1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-7144 is a medium vulnerability (CVSS 4.3) in Openstack Keystonemiddleware, published October 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in keystonemiddleware 0.11.0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open