CVE-2013-2255

MediumCVSS 5.9/10Last modified Jun 16, 2026

Description

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
OpenStack	Keystone	2013
OpenStack	Compute	2013.1

References

https://access.redhat.com/security/cve/cve-2013-2255Vendor Advisory
https://bugs.launchpad.net/ossn/+bug/1188189Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2255Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85562Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-2255Third Party Advisory
https://www.securityfocus.com/bid/61118Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-2255Vendor Advisory
https://bugs.launchpad.net/ossn/+bug/1188189Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2255Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/85562Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-2255Third Party Advisory
https://www.securityfocus.com/bid/61118Third Party Advisory, VDB Entry

Timeline

Published: Nov 1, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-22566.0OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which CVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness CVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User Impersonation CVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview CVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness CVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure CVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure CVE-2013-22635.0Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso CVE-2013-22645.0The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 CVE-2013-22667.8libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms CVE-2013-22677.2PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the sys CVE-2013-22687.5Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.