CVE:CVE-2013-2255
CNNVD:CNNVD-201406-369
OpenStack Cinder等都是美国国家航空航天局（National Aeronautics and Space Administration）和美国Rackspace公司合作研发的云平台管理项目中的产品。Cinder为其提供块存储服务功能。OpenStack Keystone是其中的一个用于身份验证的项目，提供身份、令牌、目录和策略服务。
OpenStack Keystone 2013版本和OpenStack Compute 2013.1版本中的HTTPSConnections存在安全漏洞。攻击者可借助中间人技术来利用该漏洞欺骗服务器。
solution:Upgrade openstack compute to a higher version than 2013.1,and avoid the version 2013.1; Upgrade openstack keystone to a higher version than 2013,and avoid the version 2013; Upgrade redhat openstack to a higher version than 3.0,4.0,and avoid the version 3.0,4.0; Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0