CVE-2013-2255 OpenStack Keystone and other components vulnerable to Improper Certificate Validation
OpenStack components fail to validate SSL certificates, allowing attackers to intercept traffic via man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2255?
CVE-2013-2255 is a medium-severity vulnerability in Debian Debian Linux, published on 1 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
Weakness: CWE-295
Which versions are affected by CVE-2013-2255?
12 open source packages ship an affected version, including cinder, keystone and neutron. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
cinder PyPI | All versions | 7.0.0a0 |
cinder PyPI | All versions | 7.0.0a0 |
cinder PyPI | All versions | 7.0.0a0 |
keystone PyPI | All versions | 8.0.0a0 |
keystone PyPI | All versions | 8.0.0a0 |
keystone PyPI | All versions | 8.0.0a0 |
6 more packages
neutron PyPI | All versions | 7.0.0a0 |
neutron PyPI | All versions | 7.0.0a0 |
neutron PyPI | All versions | 7.0.0a0 |
python-keystoneclient PyPI | All versions | 0.4.0 |
python-keystoneclient PyPI | All versions | 0.4.0 |
python-keystoneclient PyPI | All versions | 0.4.0 |
Products include Debian Debian Linux, Openstack Compute, Openstack Keystone, Redhat Openstack.
How do I fix CVE-2013-2255?
Upgrade cinder to 7.0.0a0 or later.
Is CVE-2013-2255 being exploited?
There is no known exploitation of CVE-2013-2255 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2013-2255, GHSA-qh2x-hpf9-cf2g, PYSEC-2026-2413, PYSEC-2026-2677, PYSEC-2026-3034, PYSEC-2026-656.