---
title: "CVE-2013-2255\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2013-2255?format=md
keywords: index, follow
---

# CVE-2013-2255

Publication date 1 November 2019

Last updated 25 August 2025

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**5.9 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2013-2255?format=md#impact-score)

Toggle side navigation

## Description

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and
possibly other OpenStack components, fail to validate server-side SSL
certificates.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2013-2255?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| cinder | 13.04 raring | Ignored |
| 12.10 quantal | Ignored |
| 12.04 LTS precise | Not in release |
| 10.04 LTS lucid | Not in release |
| keystone | 13.04 raring | Ignored |
| 12.10 quantal | Ignored |
| 12.04 LTS precise | Ignored |
| 10.04 LTS lucid | Not in release |
| nova | 13.04 raring | Ignored |
| 12.10 quantal | Ignored |
| 12.04 LTS precise | Ignored |
| 10.04 LTS lucid | Not in release |
| python-keystoneclient | 13.04 raring | Ignored |
| 12.10 quantal | Ignored |
| 12.04 LTS precise | Ignored |
| 10.04 LTS lucid | Not in release |
| quantum | 13.04 raring | Ignored |
| 12.10 quantal | Ignored |
| 12.04 LTS precise | Ignored |
| 10.04 LTS lucid | Not in release |
| swift | 13.04 raring | Not affected |
| 12.10 quantal | Not affected |
| 12.04 LTS precise | Not affected |
| 10.04 LTS lucid | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [jdstrand](https://launchpad.net/~jdstrand)

swift not-affected per upstream
per upstream, all occurences are "for serverside node-to-node
communication that could be assumed to happen on private networks". 'use\_ssl'
does convey protection, but there is no way to specify a ca\_file. Adjusting
priority to low since client to server communications are not affected (just
server to server and middleware to server) and upstream and Ubuntu
documentation all state the OpenStack components should be on a trusted
network segment
uses httplib.HTTPSConnection objects which are not fixed in Ubuntu.
Could use pycurl, python3, or httplib2.
upstream will fix as a secure feature in a future version because
this will break upgrades. Nothing to be done at this time. Leaving 13.10
open, but deferred, since the 13.10 will have a newer version.
Ubuntu 13.10 released before fix from upstream, ignoring keystone
Ubuntu 13.10 released with python-keystoneclient 0.3, ignoring
Ubuntu 13.10 released before fix from upstream, ignoring cinder
Ubuntu 13.10 released before fix from upstream, ignoring nova

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

5.9 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | High |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | High |
  | Availability impact | None |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 5.9 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2255)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-2255)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2013-2255)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2013-2255)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2013-2255>