OpenStack Keystone and other components vulnerable to Improper Certificate Validation

MEDIUM 5.9CVE-2013-2255 · GHSA-qh2x-hpf9-cf2g · PYSEC-2026-2413 · Published 01/11/2019 · updated 16/06/2026

Package	Affected versions	Patched versions
cinder PyPI	`< 7.0.0a0`	`7.0.0a0`
keystone PyPI	`< 8.0.0a0`	`8.0.0a0`
neutron PyPI	`< 7.0.0a0`	`7.0.0a0`
python-keystoneclient PyPI	`< 0.4.0`	`0.4.0`
compute openstack	`= 2013.1`	No fix yet
keystone openstack	`= 2013`	No fix yet
openstack redhat	`= 3.0= 4.0`	No fix yet

Description

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.

NVD description

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.

References

nvd.nist.gov/vuln/detail/CVE-2013-2255 · ADVISORY
openstack/cinder commit 0f9652d · WEB
openstack/keystone commit 5bd4c29 · WEB
openstack/neutron commit 7255e05 · WEB
openstack/python-keystoneclient commit 20e166f · WEB
access.redhat.com/security/cve/cve-2013-2255 · WEB
bugs.launchpad.net/ossn/+bug/1188189 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
bugzilla.suse.com/show_bug.cgi · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/85562 · WEB
security-tracker.debian.org/tracker/CVE-2013-2255 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free