CVE-2014-7144: Openstack Keystonemiddleware

Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days.

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.

Affected products

• Openstack Keystonemiddleware: version 1.0.0 only; version 1.1.0 only; version 1.1.1 only
• Openstack Python-Keystoneclient: up to and including 0.10.1

Published 2014-10-02. Last modified 2026-06-17.