python-keystoneclient, python-keystonemiddleware vulnerabilities

6 August 2015

python-keystoneclient, python-keystonemiddleware vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 15.04
• Ubuntu 14.04 LTS

Summary

Keystone could be made to expose sensitive information over the network.

Software Description

• python-keystoneclient - Client library for OpenStack Identity API
• python-keystonemiddleware - Client library for OpenStack Identity API

Details

Qin Zhao discovered Keystone disabled certification verification when the “insecure” option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

Brant Knudson discovered Keystone disabled certification verification when the “insecure” option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.04

python-keystoneclient - 1:1.2.0-0ubuntu1.1

python-keystonemiddleware - 1.5.0-0ubuntu1.1

Ubuntu 14.04 LTS

python-keystoneclient - 1:0.7.1-ubuntu1.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Keystone to make all the necessary changes.

References

• CVE-2014-7144
• CVE-2015-1852