4.3
CVE-2014-7144
- EPSS 0.37%
- Published 02.10.2014 14:55:04
- Last modified 12.04.2025 10:46:40
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Data is provided by the National Vulnerability Database (NVD)
Openstack ≫ Keystonemiddleware Version1.0.0
Openstack ≫ Keystonemiddleware Version1.1.0
Openstack ≫ Keystonemiddleware Version1.1.1
Openstack ≫ Python-keystoneclient Version <= 0.10.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.37% | 0.577 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:P/A:N
|