CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-1852

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 52.7%

CVSS Severity

CVSS v2 Score 4.3

References

Products affected by CVE-2015-1852

Openstack » Keystonemiddleware » Version: 1.0.0

cpe:2.3:a:openstack:keystonemiddleware:1.0.0
Openstack » Keystonemiddleware » Version: 1.1.0

cpe:2.3:a:openstack:keystonemiddleware:1.1.0
Openstack » Keystonemiddleware » Version: 1.1.1

cpe:2.3:a:openstack:keystonemiddleware:1.1.1
Openstack » Keystonemiddleware » Version: 1.2.0

cpe:2.3:a:openstack:keystonemiddleware:1.2.0
Openstack » Keystonemiddleware » Version: 1.3.0

cpe:2.3:a:openstack:keystonemiddleware:1.3.0
Openstack » Keystonemiddleware » Version: 1.3.1

cpe:2.3:a:openstack:keystonemiddleware:1.3.1
Openstack » Keystonemiddleware » Version: 1.3.2

cpe:2.3:a:openstack:keystonemiddleware:1.3.2
Openstack » Keystonemiddleware » Version: 1.4.0

cpe:2.3:a:openstack:keystonemiddleware:1.4.0
Openstack » Keystonemiddleware » Version: 1.5.0

cpe:2.3:a:openstack:keystonemiddleware:1.5.0
Openstack » Python-Keystoneclient » Version: 0.2.2

cpe:2.3:a:openstack:python-keystoneclient:0.2.2
Openstack » Python-Keystoneclient » Version: 0.2.3

cpe:2.3:a:openstack:python-keystoneclient:0.2.3
Openstack » Python-Keystoneclient » Version: 0.2.4

cpe:2.3:a:openstack:python-keystoneclient:0.2.4
Openstack » Python-Keystoneclient » Version: 0.2.5

cpe:2.3:a:openstack:python-keystoneclient:0.2.5
Openstack » Python-Keystoneclient » Version: 0.3.0

cpe:2.3:a:openstack:python-keystoneclient:0.3.0
Openstack » Python-Keystoneclient » Version: 0.3.1

cpe:2.3:a:openstack:python-keystoneclient:0.3.1
Openstack » Python-Keystoneclient » Version: 0.3.2

cpe:2.3:a:openstack:python-keystoneclient:0.3.2
Openstack » Python-Keystoneclient » Version: 0.4.2

cpe:2.3:a:openstack:python-keystoneclient:0.4.2
Canonical » Ubuntu Linux » Version: 14.04

cpe:2.3:o:canonical:ubuntu_linux:14.04
Canonical » Ubuntu Linux » Version: 15.04

cpe:2.3:o:canonical:ubuntu_linux:15.04

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2015-1852

Products

Pricing

Contact Us