CVE-2015-1852

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

• CWE-17

• http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1677.html
• http://rhn.redhat.com/errata/RHSA-2015-1685.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
• http://www.securityfocus.com/bid/74187Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2705-1Third Party Advisory
• https://bugs.launchpad.net/keystonemiddleware/+bug/1411063
• http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1677.html
• http://rhn.redhat.com/errata/RHSA-2015-1685.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
• http://www.securityfocus.com/bid/74187Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2705-1Third Party Advisory
• https://bugs.launchpad.net/keystonemiddleware/+bug/1411063

Published

Apr 17, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-1846unzoo allows remote attackers to cause a denial of service (…
• CVE-2015-1847Directory traversal vulnerability in the web request/respons…
• CVE-2015-1848The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not se…
• CVE-2015-1849AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Applicat…
• CVE-2015-1850Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-1851OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before…
• CVE-2015-1853chrony before 1.31.1 does not properly protect state variabl…6.5
• CVE-2015-1854389 Directory Server before 1.3.3.10 allows attackers to byp…
• CVE-2015-1855verify_certificate_identity in the OpenSSL extension in Ruby…5.9
• CVE-2015-1856OpenStack Object Storage (Swift) before 2.3.0, when allow_ve…
• CVE-2015-1857The odl-mdsal-apidocs feature in OpenDaylight Helium allow r…5.3
• CVE-2015-1858Multiple buffer overflows in gui/image/qbmphandler.cpp in th…