CVE-2015-1852
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-17
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- openstack:keystonemiddleware
- openstack:python-keystoneclient
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p9wq-mjh8-q72m | PyPI | keystonemiddleware | <1.6.0 | 1.6.0 |
| GHSA-p9wq-mjh8-q72m | PyPI | python-keystoneclient | <1.4.0 | 1.4.0 |
| PYSEC-2015-30 | PyPI | keystonemiddleware | <1.6.0 | 1.6.0 |
| PYSEC-2015-31 | PyPI | python-keystoneclient | <1.4.0 | 1.4.0 |