USN-2705-1: Keystone vulnerabilities

Packages

python-keystoneclient - Client library for OpenStack Identity API
python-keystonemiddleware - Client library for OpenStack Identity API

Details

Qin Zhao discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

Brant Knudson discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)

Qin Zhao discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)

Brant Knudson discovered Keystone disabled certification verification when
the “insecure” option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)

Update instructions

After a standard system update you need to restart Keystone to make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
15.04 vivid	python-keystoneclient – 1:1.2.0-0ubuntu1.1
15.04 vivid	python-keystonemiddleware – 1.5.0-0ubuntu1.1
14.04 trusty	python-keystoneclient – 1:0.7.1-ubuntu1.2

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References