The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-keystoneclientUpgrade python-keystonemiddleware | Jul 30, 2024 | Oct 2, 2014 |
| Oracle Solaris | — | Upgrade library/python/keystoneclient to version 0.8.0-0.175.2.4.0.3.0 on Solaris 11.2Upgrade library/python/keystoneclient-26 to version 0.8.0-0.175.2.4.0.3.0 on Solaris 11.2Upgrade runtime/python-27 to version 2.7.8-0.175.2.4.0.6.0 on Solaris 11.2Upgrade library/python/keystoneclient-27 to version 0.8.0-0.175.2.4.0.3.0 on Solaris 11.2Upgrade runtime/python-26 to version 2.6.8-0.175.2.4.0.6.0 on Solaris 11.2 | May 29, 2017 | Oct 2, 2014 |
| Suse | — | Upgrade python2-keystoneclientUpgrade python3-keystoneclient | Feb 4, 2022 | Oct 2, 2014 |
| Ubuntu | — | Upgrade python-keystoneclientUpgrade python-keystonemiddleware | Nov 8, 2024 | Oct 2, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub