CVE-2015-1852

OpenStack keystonemiddleware < 1.6.0 and python-keystoneclient < 1.4.0: Insecure "insecure" option bypass

• CVSS 4.3
• CWE-17
• Cryptographic
• Remote

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

CVE

CVE-2015-1852

CWE

CWE-17

CVSS base score

4.3

Published

2015-04-17

OWASP

A05 Security Misconfiguration

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update keystonemiddleware to version 1.6.0 or higher.

from keystonemiddleware import s3_token

def configure_s3_token(app, config):
    s3_token_middleware = s3_token.S3Token(app, {
        'insecure': config.get('insecure', False)
    })
    
    return s3_token_middleware

from keystonemiddleware import s3_token

def configure_s3_token(app, config):
    if config.get('insecure', False):
        raise ValueError("Insecure option is not allowed. Please set to False.")
    
    s3_token_middleware = s3_token.S3Token(app, {
        'certifi': True,
        'insecure': False
    })
    
    return s3_token_middleware

@misc{vaitp:cve20151852,
  title        = {{OpenStack keystonemiddleware < 1.6.0 and python-keystoneclient < 1.4.0: Insecure "insecure" option bypass}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2015},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-1852},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-1852/}}
}