The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1685 advisory.

    Python-keystoneclient is a client library and a command-line utility     for interacting with the OpenStack Identity API.

    It was discovered that some items in the S3Token configuration as used by     python-keystoneclient were incorrectly evaluated as strings, an issue     similar to CVE-2014-7144. If the insecure option was set to false, the     option would be evaluated as true, resulting in TLS connections being     vulnerable to man-in-the-middle attacks. Note: The insecure option     defaults to false, so setups that do not specifically define     insecure=false are not affected. (CVE-2015-1852)

    Red Hat would like to thank the OpenStack project for reporting this issue.
    Upstream acknowledges Brant Knudson from IBM as the original reporter.

    All python-keystoneclient users are advised to upgrade to these updated     packages, which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before
    1.4.0 disables certification verification when the "insecure" option is set in a paste configuration
    (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle
    attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. (CVE-2015-1852)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2705-1 advisory.

    Qin Zhao discovered Keystone disabled certification verification when the insecure option is set in a     paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct     machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

    Brant Knudson discovered Keystone disabled certification verification when the insecure option is set in     a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct     machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to upstream 1.3.2 which incldes fix for CVE-2015-1852 Update to upstream 1.3.1 + S3token incorrect condition expression for ssl_insecure CVE-2015-1852

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
234378	RHEL 6 / 7 : python-keystoneclient (RHSA-2015:1685)	Nessus	Red Hat Local Security Checks	Local	high
417438	SCA: security update for keystonemiddleware, python-keystoneclient (GHSA-p9wq-mjh8-q72m)	Tenable Cloud Security	SCA Checks	Local	high
417438	SCA: security update for keystonemiddleware, python-keystoneclient (GHSA-p9wq-mjh8-q72m)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
85253	Ubuntu 14.04 LTS : Keystone vulnerabilities (USN-2705-1)	Nessus	Ubuntu Local Security Checks	Local	medium
84855	Fedora 22 : python-keystonemiddleware-1.3.2-1.fc22 (2015-11656)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2015-1852

high

Tenable Plugins

high

high

high

medium

medium