Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 597
Alerts This Week
Warning Icon 1 597

Red Hat 6.0: RHSA-2015:1677-01 Moderate TLS Risk in Python Keystoneclient

red hat
Calendar Grey August 24, 2015
Dist Redhat Esm H88
Security patch released for python-keystoneclient and python-keystonemiddleware to rectify a TLS vulnerability.
Updated python-keystoneclient and python-keystonemiddleware packages that fix one security issue are now available for Red Hat Enterprise Linux OpenStack Platform 6.0 for Red Hat E...

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258

Summary

Python-keystonemiddleware (formely python-keystoneclient) is a client library and a command line utility for interacting with the OpenStack Identity API.
Red Hat Enterprise OpenStack Platform 6.0 contains and uses both the python-keystonemiddleware and python-keystoneclient versions of this package.
It was discovered that some items in the the S3Token configuration as used by python-keystonemiddleware and python-keystoneclient were incorrectly evaluated as strings, an issue similar to CVE-2014-7144. This would result in a setting for 'insecure=false' to evaluate as true and leave TLS connections open to MITM. (CVE-2015-1852)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brant Knudson from IBM as the original reporter.
Note: "insecure" defaults to false, so setups that do not specifically define "insecure=false" are unaffected.
All python-keystoneclient users are advised to upgrade to these updated packages, which correct these issues.

Topics%20covered

Topics Covered

security advisory moderate Red Hat TLS issue OpenStack python-keystoneclient python-keystonemiddleware

References

https://access.redhat.com/security/cve/CVE-2015-1852 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7:
Source: python-keystoneclient-0.11.1-2.el7ost.src.rpm python-keystonemiddleware-1.3.2-1.el7ost.src.rpm
noarch: python-keystoneclient-0.11.1-2.el7ost.noarch.rpm python-keystoneclient-doc-0.11.1-2.el7ost.noarch.rpm python-keystonemiddleware-1.3.2-1.el7ost.noarch.rpm python-keystonemiddleware-doc-1.3.2-1.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Advisory ID: RHSA-2015:1677-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2015:1677.html
Issue date: 2015-08-24

Topic

Updated python-keystoneclient and python-keystonemiddleware packages thatfix one security issue are now available for Red Hat Enterprise LinuxOpenStack Platform 6.0 for Red Hat Enterprise Linux 7.Red Hat Product Security has rated this update as having Moderate securityimpact. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available from the CVE link in theReferences section.

Topics%20covered

Topics Covered

security advisory moderate Red Hat TLS issue OpenStack python-keystoneclient python-keystonemiddleware

Relevant Releases Architectures

Red Hat Enterprise Linux OpenStack Platform 6.0 for RHEL 7 - noarch

Bugs Fixed

1209527 - CVE-2015-1852 OpenStack keystonemiddleware/keystoneclient: S3Token TLS cert verification option not honored

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.