USN-2705-1: Keystone vulnerabilities
Ubuntu Security Notice USN-2705-1
5th August, 2015
python-keystoneclient, python-keystonemiddleware vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 15.04
- Ubuntu 14.04 LTS
Summary
Keystone could be made to expose sensitive information over the network.
Software description
- python-keystoneclient - Client library for OpenStack Identity API
- python-keystonemiddleware - Client library for OpenStack Identity API
Details
Qin Zhao discovered Keystone disabled certification verification when
the "insecure" option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
man-in-the-middle attacks via a crafted certificate. (CVE-2014-7144)
Brant Knudson discovered Keystone disabled certification verification when
the "insecure" option is set in a paste configuration (paste.ini)
file regardless of the value, which allows remote attackers to conduct
man-in-the-middle attacks via a crafted certificate. (CVE-2015-1852)
Update instructions
The problem can be corrected by updating your system to the following package version:
- Ubuntu 15.04:
- python-keystonemiddleware 1.5.0-0ubuntu1.1
- python-keystoneclient 1:1.2.0-0ubuntu1.1
- Ubuntu 14.04 LTS:
- python-keystoneclient 1:0.7.1-ubuntu1.2
To update your system, please follow these instructions: http://ift.tt/17VXqjU.
After a standard system update you need to restart Keystone to make
all the necessary changes.
References
from Ubuntu Security Notices http://ift.tt/1Ds7WkP