Multiple OpenStack Products SSL Certificate Validation CVE-2013-2255 Security Bypass Vulnerability

Bugtraq ID:	61118
Class:	Design Error
CVE:	CVE-2013-2255
Remote:	Yes
Local:	No
Published:	Jun 06 2013 12:00AM
Updated:	Jan 24 2014 01:26PM
Credit:	Thierry Carrez
Vulnerable:
Not Vulnerable:

Multiple OpenStack Products SSL Certificate Validation CVE-2013-2255 Security Bypass Vulnerability

Multiple OpenStack products are prone to a security-bypass vulnerability because they fail to properly validate SSL certificates from the server.

An attacker can exploit this issue to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

The following products are vulnerable:

OpenStack Cinder
OpenStack Keystone
OpenStack Compute (nova)
OpenStack neutron
OpenStack python-keystoneclient

Multiple OpenStack Products SSL Certificate Validation CVE-2013-2255 Security Bypass Vulnerability

An attacker can exploit this issue using readily available tools.

Multiple OpenStack Products SSL Certificate Validation CVE-2013-2255 Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple OpenStack Products SSL Certificate Validation CVE-2013-2255 Security Bypass Vulnerability

References: