Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · OpenStack 6 openstack:6::el7 | python-keystoneclient | 1:0.11.1-2.el7ost |
| Red Hat · OpenStack 6 openstack:6::el7 | python-keystoneclient-doc | 1:0.11.1-2.el7ost |
| Red Hat · OpenStack 6 openstack:6::el7 | python-keystonemiddleware | 0:1.3.2-1.el7ost |
| Red Hat · OpenStack 6 openstack:6::el7 | python-keystonemiddleware-doc | 0:1.3.2-1.el7ost |
Vulnerabilities 1
-
High 7.5
OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows r…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1209527
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1677.json
-
report
https://access.redhat.com/security/cve/CVE-2015-1852
-
advisory
https://www.cve.org/CVERecord?id=CVE-2015-1852
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2015-1852