Security Bulletin: IBM Spectrum Scale Object Protocols functionality is affected by security vulnerabilities in OpenStack (CVE-2015-1852 and CVE-2015-7546)

Vulnerability Details

CVEID: CVE-2015-1852
DESCRIPTION: OpenStack keystonemiddleware and python-keystoneclient is vulnerable to a man-in-the-middle attack, caused by an error in the api-paste.ini configuration file. A remote attacker could exploit this vulnerability using a specially-crafted handshake to conduct man-in-the-middle attacks to decrypt and modify traffic.
CVSS Base Score: 5.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102669 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:N)

CVEID: CVE-2015-7546
DESCRIPTION: OpenStack Keystone and keystonemiddleware could allow a remote attacker to bypass security restrictions, caused by an error when using the PKI or PKIZ token providers. By manipulating the token contents of a revoked token, the revocation check will improperly consider the token as valid. An attacker could exploit this vulnerability using a revoked token to gain unauthorized access to cloud resources.
CVSS Base Score: 6.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/110301 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)