Test ID:	1.3.6.1.4.1.25623.1.0.842402
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2705-1)
Summary:	The remote host is missing an update for the 'python-keystoneclient, python-keystonemiddleware' package(s) announced via the USN-2705-1 advisory.
Description:	Summary: The remote host is missing an update for the 'python-keystoneclient, python-keystonemiddleware' package(s) announced via the USN-2705-1 advisory. Vulnerability Insight: Qin Zhao discovered Keystone disabled certification verification when the 'insecure' option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2014-7144) Brant Knudson discovered Keystone disabled certification verification when the 'insecure' option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct machine-in-the-middle attacks via a crafted certificate. (CVE-2015-1852) Affected Software/OS: 'python-keystoneclient, python-keystonemiddleware' package(s) on Ubuntu 14.04, Ubuntu 15.04. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-7144 BugTraq ID: 69864 http://www.securityfocus.com/bid/69864 http://www.openwall.com/lists/oss-security/2014/09/25/51 RedHat Security Advisories: RHSA-2014:1783 http://rhn.redhat.com/errata/RHSA-2014-1783.html RedHat Security Advisories: RHSA-2014:1784 http://rhn.redhat.com/errata/RHSA-2014-1784.html RedHat Security Advisories: RHSA-2015:0020 http://rhn.redhat.com/errata/RHSA-2015-0020.html http://secunia.com/advisories/62709 http://www.ubuntu.com/usn/USN-2705-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-1852 74187 http://www.securityfocus.com/bid/74187 RHSA-2015:1677 http://rhn.redhat.com/errata/RHSA-2015-1677.html RHSA-2015:1685 http://rhn.redhat.com/errata/RHSA-2015-1685.html USN-2705-1 [openstack-announce] 20150414 [OSSA 2015-007] S3Token TLS cert verification option not honored (CVE-2015-1852) http://lists.openstack.org/pipermail/openstack-announce/2015-April/000350.html http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html https://bugs.launchpad.net/keystonemiddleware/+bug/1411063
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.