CVE-2015-1852
Description
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the insecure option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score
Exploitation Probability
0.219
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2015-1852 are fixed in Python-python-keystoneclient 1.4.0 | Windows |
| Vulnerabilities CVE-2015-1852 are fixed in Python-keystonemiddleware 1.6.0 | Windows |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_0.7.1-ubuntu1_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_0.7.1-ubuntu1.2_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_0.7.1-ubuntu1.3_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_1.2.0-0ubuntu1_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_1.2.0-0ubuntu1.1_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystoneclient_1.2.0-0ubuntu1.2_all.deb | Linux |
| Client library for OpenStack Identity API (USN-2705-1) python-keystonemiddleware_1.5.0-0ubuntu1.1_all.deb | Linux |
| Vulnerabilities CVE-2015-1852 are fixed in Python-python-keystoneclient for linux 1.4.0 | Linux |
| Vulnerabilities CVE-2015-1852 are fixed in Python-keystonemiddleware for linux 1.6.0 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234