oss-security - [OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <552D72B5.2010809@enovance.com>
Date: Tue, 14 Apr 2015 16:04:05 -0400
From: Tristan Cacqueray <tristan.cacqueray@...vance.com>
To: oss-security@...ts.openwall.com
Subject: [OSSA 2015-007] S3Token TLS cert verification option not honored
 (CVE-2015-1852)

===============================================================
OSSA-2015-007: S3Token TLS cert verification option not honored
===============================================================

:Date: April 14, 2015
:CVE: CVE-2015-1852


Affects
~~~~~~~
- python-keystoneclient: versions through 1.3.0
- keystonemiddleware: versions through 1.5.0


Description
~~~~~~~~~~~
Brant Knudson from IBM reported a vulnerability in keystonemiddleware
(formerly shipped as python-keystoneclient). When the 'insecure'
option is set in a S3Token paste configuration file its value is
effectively ignored and instead assumed to be true. As a result
certificate verification will be disabled, leaving TLS connections
open to MITM attacks. Note that it's unusual to explicitly add this
option and then set it to false, so the impact of this bug is thought
to be limited. All versions of s3_token middleware with TLS settings
configured are affected by this flaw.


Patches
~~~~~~~
- https://review.openstack.org/173378 (python-keystoneclient) (Icehouse)
- https://review.openstack.org/173376 (keystonemiddleware)    (Juno)
- https://review.openstack.org/173377 (python-keystoneclient) (Juno)
- https://review.openstack.org/173365 (keystonemiddleware)    (Kilo)
- https://review.openstack.org/173370 (python-keystoneclient) (Kilo)


Credits
~~~~~~~
- Brant Knudson from IBM (CVE-2015-1852)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1411063
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1852


Notes
~~~~~
- This fix will be included in keystonemiddleware 1.6.0 release and
  python-keystoneclient 1.4.0 release.

--
Tristan Cacqueray
OpenStack Vulnerability Management Team


Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.