CVE-2014-7144: openstack keystonemiddleware Cryptographic Issues
Vulnerability summary
CVE-2014-7144 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in openstack keystonemiddleware. EPSS estimates a 1.98% chance of exploitation in the next 30 days, higher than 80.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 02-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
1.98%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.98% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian2 products
- python-keystoneclient< 1:0.10.1-2
- python-keystonemiddleware< 1.0.0-3
Openstack2 products
- keystonemiddleware1.0.0 | 1.1.0 | 1.1.1
- python-keystoneclient≤ 0.10.1
PyPI2 products
- keystonemiddleware< 0.11.0 | ≥ 1.0, < 1.2.0
- python-keystoneclient< 0.11.0 | ≥ 1.0, < 1.2.0
Redhat2 products
- python-keystoneclient< 1:0.9.0-5.el6ost | < 1:0.9.0-5.el7ost | < 1:0.7.1-5.el6ost
- python-keystoneclient-doc< 1:0.9.0-5.el6ost | < 1:0.9.0-5.el7ost | < 1:0.7.1-5.el6ost
Ubuntu1 product
- python-keystoneclient< 1:0.7.1-ubuntu1.2
5 vendors · 9 products
