CVE-2015-1852 OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks

Medium 4.3 Published 17 Apr 2015 Updated 6 Aug 2024

Attackers can perform man-in-the-middle attacks if the insecure option is set in the configuration, bypassing certificate verification.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-1852?

CVE-2015-1852 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 17 Apr 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

Weakness: CWE-17

Which versions are affected by CVE-2015-1852?

6 open source packages ship an affected version, including keystonemiddleware and python-keystoneclient. It affects 3 products.

Package	Affected	Fixed in
`keystonemiddleware` PyPI	All versions	`1.6.0`
`keystonemiddleware` PyPI	All versions	`1.6.0`
`keystonemiddleware` PyPI	All versions	`1.6.0`
`python-keystoneclient` PyPI	All versions	`1.4.0`
`python-keystoneclient` PyPI	All versions	`1.4.0`
`python-keystoneclient` PyPI	All versions	`1.4.0`

Linux distribution packages (20)

`python-keystoneclient` Red Hat:openstack:5::el6	All versions	`1:0.9.0-6.el6ost`
`python-keystoneclient-doc` Red Hat:openstack:5::el6	All versions	`1:0.9.0-6.el6ost`
`python-keystoneclient` Red Hat:openstack:5::el7	All versions	`1:0.9.0-6.el7ost`
`python-keystoneclient-doc` Red Hat:openstack:5::el7	All versions	`1:0.9.0-6.el7ost`
`python-keystoneclient` Red Hat:openstack:6::el7	All versions	`1:0.11.1-2.el7ost`
`python-keystoneclient-doc` Red Hat:openstack:6::el7	All versions	`1:0.11.1-2.el7ost`
`python-keystonemiddleware` Red Hat:openstack:6::el7	All versions	`0:1.3.2-1.el7ost`
`python-keystonemiddleware-doc` Red Hat:openstack:6::el7	All versions	`0:1.3.2-1.el7ost`
`python-glanceclient` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`0.15.0-3.1`
`python-keystoneclient` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`1.0.0-16.1`
`python-keystoneclient` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`1.0.0-19.1`
`python-keystonemiddleware` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`1.2.0-4.1`
`python-novaclient` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`2.20.0-6.1`
`python-swiftclient` SUSE:Cloud Compute Node for SUSE Linux Enterprise 12 5	All versions	`2.3.1-3.1`
`python-glanceclient` SUSE:OpenStack Cloud 5	All versions	`0.15.0-9.2`
`python-keystoneclient` SUSE:OpenStack Cloud 5	All versions	`1.0.0-11.1`
`python-keystonemiddleware` SUSE:OpenStack Cloud 5	All versions	`1.2.0-11.2`
`python-novaclient` SUSE:OpenStack Cloud 5	All versions	`2.20.0-9.2`
`python-openstackclient` SUSE:OpenStack Cloud 5	All versions	`0.4.1-9.2`
`python-keystonemiddleware` openSUSE:Tumbleweed	All versions	`4.9.0-1.3`

Products include Canonical Ubuntu Linux, Openstack Keystonemiddleware, Openstack Python-Keystoneclient.

How do I fix CVE-2015-1852?

Upgrade keystonemiddleware to 1.6.0 or later.

Is CVE-2015-1852 being exploited?

There is no known exploitation of CVE-2015-1852 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-1852, GHSA-p9wq-mjh8-q72m, PYSEC-2015-30, PYSEC-2015-31, RHSA-2015:1677, RHSA-2015:1685 and 5 more.