Ubuntu Security Notice 2705-1 - Qin Zhao discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. Brant Knudson discovered Keystone disabled certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. Various other issues were also addressed.
562e20b238e38b9c71afcc748894aa1f5d751ae0722e5ca24eb36405f9cf09adRed Hat Security Advisory 2015-0020-01 - Python-keystoneclient is a client library and a command line utility for interacting with the OpenStack Identity API. The OpenStack Identity auth_token middleware component handles the authentication of tokens with keystone. It was found that python-keystoneclient treated all settings in paste.ini files as string types. If the "insecure" option were set to any value in a paste.ini configuration file, it would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks.
db2733dcb2cacdbcea7e501ffd9d1bce5a700ada5716c9221dd25060a49a090cRed Hat Security Advisory 2014-1784-01 - Python-keystoneclient is a client library and a command line utility for interacting with the OpenStack Identity API. It was found that Python-keystoneclient treated all settings in paste.ini files as string types. If the "insecure" option were set to any value in a paste.ini configuration file, it would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks. Note that when the "insecure" option was not set in paste.ini, it evaluated to false, and verification was performed.
0c4491814116023026031695bec3a54972e35e2266df6434824c867935cf2bc7Red Hat Security Advisory 2014-1783-01 - Python-keystoneclient is a client library and a command line utility for interacting with the OpenStack Identity API. It was found that Python-keystoneclient treated all settings in paste.ini files as string types. If the "insecure" option were set to any value in a paste.ini configuration file, it would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks. Note that when the "insecure" option was not set in paste.ini, it evaluated to false, and verification was performed.
39e09fe62fba4a26a07ee3f4e9e6e5e26984232ab7264633c21ba5fbb0e6bf42
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed