CVE-2014-7144

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure"…

published October 2, 2014

CVSS
—
EPSS
2%
Percentile
79.5
In the wild
Unconfirmed
What it is

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01903 · 79.5th percentile
Published
2014-10-02T14:00Z
EPSS history
Timeline
  • 02 OCT 14:00Z
    OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure"…
    cvelistv5