yahoo-eng-team team mailing list archive

[Sean Dague <sean@xxxxxxxxx>]

Public bug reported:

EC2KeystoneAuth uses httplib.HTTPSConnection objects. In Python 2.x
those do not perform CA checks so client connections are vulnerable to
MiM attacks.

This should use requests instead, and pick up the local cacert params if
needed.

** Affects: nova
     Importance: Critical
         Status: Triaged


** Tags: ec2

** Changed in: nova
       Status: New => Triaged

** Changed in: nova
   Importance: Undecided => Critical

** Tags added: ec2

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1373992

Title:
  EC2 keystone auth token is using unsafe SSL connection

Status in OpenStack Compute (Nova):
  Triaged

Bug description:
  EC2KeystoneAuth uses httplib.HTTPSConnection objects. In Python 2.x
  those do not perform CA checks so client connections are vulnerable to
  MiM attacks.

  This should use requests instead, and pick up the local cacert params
  if needed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1373992/+subscriptions