CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-7546
https://notcve.org/view.php?id=CVE-2015-7546
03 Feb 2016 — The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token. El servicio de identificación en OpenStac... • http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-1852 – keystonemiddleware/keystoneclient: S3Token TLS cert verification option not honored
https://notcve.org/view.php?id=CVE-2015-1852
17 Apr 2015 — The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. El middleware s3_token en OpenStack keystonemiddleware anterior a 1.6.0 y python-keystoneclient anterior a 1.4.0 deshabilita la... • http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html • CWE-17: DEPRECATED: Code CWE-295: Improper Certificate Validation •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2014-7144 – python-keystoneclient: TLS certificate verification disabled
https://notcve.org/view.php?id=CVE-2014-7144
02 Oct 2014 — OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate. OpenStack keystonemiddleware (anteriormente python-keystoneclient) 0.x anterior a 0.11.0 y 1.x anterior a 1.2.0 deshabilita la verificación de certificados cuando la opción 'insegu... • http://rhn.redhat.com/errata/RHSA-2014-1783.html • CWE-295: Improper Certificate Validation CWE-310: Cryptographic Issues •