Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 546640 (CVE-2015-1852) - <dev-python/python-keystoneclient-{1.0.0-r1,1.3.0-r2},<dev-python/keystonemiddleware-1.5.0: MITM TLS Verification (CVE-2015-1852)
Summary: <dev-python/python-keystoneclient-{1.0.0-r1,1.3.0-r2},<dev-python/keystonemid...
Status: RESOLVED FIXED
Alias: CVE-2015-1852
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: C3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-14 23:05 UTC by Matthew Thode ( prometheanfire )
Modified: 2015-05-11 20:32 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-04-14 23:05:57 UTC 
Title: S3Token TLS cert verification option not honored
Reporter: Brant Knudson (IBM)
Products: keystonemiddleware, python-keystoneclient
Affects: versions through 1.5.0 (keystonemiddleware),
         versions through 1.3.0 (python-keystoneclient)

Description:
Brant Knudson from IBM reported a vulnerability in keystonemiddleware
(formerly shipped as python-keystoneclient). When the 'insecure' option
is set in a S3Token paste configuration file its value is effectively
ignored and instead assumed to be true. As a result certificate
verification will be disabled, leaving TLS connections open to MITM
attacks. Note that it's unusual to explicitly add this option and then
set it to false, so the impact of this bug is thought to be limited. All
versions of s3_token middleware with TLS settings configured are
affected by this flaw.


I've backported the patch to 1.0.0 so we can do a fast stablization.  arches, please do so (x86 and amd64).

Reproducible: Always
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-04-14 23:08:31 UTC 
to be clear, stabilize dev-python/python-keystoneclient-1.0.0-r1
Comment 2 Yury German Gentoo Infrastructure gentoo-dev 2015-04-15 21:59:18 UTC 
Arches, please test and mark stable:

=dev-python/python-keystoneclient-1.0.0-r1

Target Keywords : "amd64 x86"

Thank you!
Comment 3 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-04-16 02:35:08 UTC 
bad versions removed

1.0.0-r1 and >=1.3.0-r2 have the fix
Comment 4 Yury German Gentoo Infrastructure gentoo-dev 2015-04-17 01:28:26 UTC 
Arches and Maintainer(s), Thank you for your work.

GLSA Vote: Yes
Comment 5 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2015-05-11 20:06:11 UTC 
GLSA vote: no.
Comment 6 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-05-11 20:31:05 UTC 
GLSA Vote: No, closing noglsa
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2015-05-11 20:32:30 UTC 
CVE-2015-1852 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-1852):
  The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and
  python-keystoneclient before 1.4.0 disables certification verification when
  the "insecure" option is set in a paste configuration (paste.ini) file
  regardless of the value, which allows remote attackers to conduct
  man-in-the-middle attacks via a crafted certificate, a different
  vulnerability than CVE-2014-7144.