The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python-keystoneclientUpgrade python-keystonemiddleware | Jul 30, 2024 | Apr 17, 2015 |
| Oracle Solaris | — | Upgrade library/python/keystoneclient to version 1.0.0-0.175.2.10.0.5.0 on Solaris 11.2Upgrade library/python/keystoneclient-27 to version 1.0.0-0.175.2.10.0.5.0 on Solaris 11.2Upgrade library/python/keystonemiddleware-27 to version 1.3.1-0.175.2.10.0.5.0 on Solaris 11.2Upgrade library/python/keystonemiddleware-26 to version 1.3.1-0.175.2.10.0.5.0 on Solaris 11.2Upgrade library/python/keystonemiddleware to version 1.3.1-0.175.2.10.0.5.0 on Solaris 11.2Upgrade library/python/keystoneclient-26 to version 1.0.0-0.175.2.10.0.5.0 on Solaris 11.2 | May 29, 2017 | Apr 17, 2015 |
| Suse | — | Upgrade python3-keystoneclientUpgrade python2-keystoneclient | Feb 4, 2022 | Apr 17, 2015 |
| Ubuntu | — | Upgrade python-keystoneclientUpgrade python-keystonemiddleware | Nov 8, 2024 | Apr 17, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub