CVE-2014-7144
openstack: no CVSS score yet. EPSS 1.9% chance of exploitation in the next 30 days. Fixed in keystonemiddleware 0.11.0, 1.2.0.
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
- EPSS
- 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
- CWE
- CWE-310
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:keystonemiddleware
- openstack:python-keystoneclient
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7f2c-vp52-gmfw | PyPI | keystonemiddleware | <0.11.0 | 0.11.0 |
| GHSA-7f2c-vp52-gmfw | PyPI | keystonemiddleware | >=1.0 <1.2.0 | 1.2.0 |
| GHSA-7f2c-vp52-gmfw | PyPI | python-keystoneclient | <0.11.0 | 0.11.0 |
| GHSA-7f2c-vp52-gmfw | PyPI | python-keystoneclient | >=1.0 <1.2.0 | 1.2.0 |
| PYSEC-2014-26 | PyPI | keystonemiddleware | <0.11.0 >=1.0 <1.2.0 | 0.11.0, 1.2.0 |
| PYSEC-2014-71 | PyPI | python-keystoneclient | <0.11.0 >=1.0 <1.2.0 | 0.11.0, 1.2.0 |