Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1143808 - (CVE-2014-7144) CVE-2014-7144 python-keystoneclient: TLS certificate verification disabled
CVE-2014-7144 python-keystoneclient: TLS certificate verification disabled
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20140806,repor...
: Security
Depends On: 1143809 1143810 1148340 1148341 1148342 1152381
Blocks: 1143811
  Show dependency tree / graph
 
Reported: 2014-09-18 00:12 EDT by Murray McAllister
Modified: 2016-04-26 11:57 EDT (History)
30 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was found that python-keystoneclient treated all settings in paste.ini files as string types. If the "insecure" option were set to any value in a paste.ini configuration file, it would be evaluated as true, resulting in TLS connections being vulnerable to man-in-the-middle attacks.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-01-08 14:10:48 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1783 normal SHIPPED_LIVE Moderate: python-keystoneclient security and bug fix update 2014-11-03 08:36:52 EST
Red Hat Product Errata RHSA-2014:1784 normal SHIPPED_LIVE Moderate: python-keystoneclient security and bug fix update 2014-11-03 08:36:46 EST
Red Hat Product Errata RHSA-2015:0020 normal SHIPPED_LIVE Moderate: python-keystoneclient security update 2015-01-08 18:05:03 EST

  None (edit)
Description Murray McAllister 2014-09-18 00:12:18 EDT 
The OpenStack project reports:

""
Title: TLS cert verification option not honoured in paste configs
Reporter: Qin Zhao (IBM)
Products: keystonemiddleware, python-keystoneclient
Versions: versions up to 1.1.1 (keystonemiddleware), versions up to 0.10.1
(python-keystoneclient)

Description:
Qin Zhao from IBM reported a vulnerability in keystonemiddleware (formerly
shipped as python-keystoneclient). When the 'insecure' SSL option is set in 
a paste configuration file it is effectively ignored, regardless of its 
value.  As a result certificate verification will be disabled, leaving TLS
connections open to MITM attacks. All versions of keystonemiddleware with
TLS settings configured via a paste.ini file are affected by this flaw.
""

Upstream fix:

https://review.openstack.org/#/c/112232/

References:
http://launchpad.net/bugs/1353315
http://www.openwall.com/lists/oss-security/2014/09/17/3
Comment 2 Murray McAllister 2014-09-18 00:16:40 EDT 
Created python-keystoneclient tracking bugs for this issue:

Affects: fedora-all [bug 1143809]
Comment 4 Murray McAllister 2014-09-25 00:11:20 EDT 
MITRE assigned CVE-2014-7144 to this issue:

http://seclists.org/oss-sec/2014/q3/628
Comment 5 Murray McAllister 2014-09-25 22:55:17 EDT 
OpenStack's advisory:

http://seclists.org/oss-sec/2014/q3/731
Comment 13 errata-xmlrpc 2014-11-03 03:40:40 EST 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 7

Via RHSA-2014:1784 https://rhn.redhat.com/errata/RHSA-2014-1784.html
Comment 14 errata-xmlrpc 2014-11-03 03:40:54 EST 
This issue has been addressed in the following products:

  OpenStack 5 for RHEL 6

Via RHSA-2014:1783 https://rhn.redhat.com/errata/RHSA-2014-1783.html
Comment 16 errata-xmlrpc 2015-01-08 13:05:21 EST 
This issue has been addressed in the following products:

  OpenStack 4 for RHEL 6

Via RHSA-2015:0020 https://rhn.redhat.com/errata/RHSA-2015-0020.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.