CVE-2014-7144

Description

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

How to fix CVE-2014-7144

To remediate CVE-2014-7144, upgrade the affected package to a fixed version below.

• —upgrade to 1:0.10.1-2 or later
• —upgrade to 1.0.0-3 or later
• —upgrade to 0.11.0 or later
• —upgrade to 0.11.0 or later
• —upgrade to 0.11.0 or later
• —upgrade to 0.11.0 or later

Is CVE-2014-7144 being exploited?

Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.

Affected packages (6)

• from 0, < 1:0.10.1-2
• from 0, < 1.0.0-3
• from 0, < 0.11.0
• from 0, < 0.11.0, >= 1.0, < 1.2.0
• from 0, < 0.11.0
• from 0, < 0.11.0, >= 1.0, < 1.2.0

CVSS scores

References (16)

• ADVISORYsecunia.com/advisories/62709
• ADVISORYgithub.com/advisories/GHSA-7f2c-vp52-gmfw
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-7144
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-7144
• WEB