Vulnerability	Vulnerable Version
M Man-in-the-Middle (MitM) Affected versions of `python-keystoneclient` are vulnerable to Man-in-the-Middle (MitM) attacks. The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144. How to fix Man-in-the-Middle (MitM)? Upgrade `python-keystoneclient` to version 1.4.0 or higher.	[,1.4.0)
M Access Restriction Bypass `python-keystoneclient` is a Client Library for OpenStack Identity The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached." How to fix Access Restriction Bypass? Upgrade to version `0.7.0` or greater.	[,0.7.0)

Man-in-the-Middle (MitM)

Affected versions of python-keystoneclient are vulnerable to Man-in-the-Middle (MitM) attacks.

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.

How to fix Man-in-the-Middle (MitM)?

Upgrade python-keystoneclient to version 1.4.0 or higher.

[,1.4.0)

Access Restriction Bypass

python-keystoneclient is a Client Library for OpenStack Identity The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

How to fix Access Restriction Bypass?

Upgrade to version 0.7.0 or greater.

[,0.7.0)

Go back to all versions of this package