DEBIAN-CVE-2026-44393

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-44393
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-44393
Upstream
  • CVE-2026-44393
Published
2026-06-04T16:16:38Z
Modified
2026-09-14T17:03:35Z
Severity
  • 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.

References

Affected packages

Debian:12 / python-oslo.messaging

Package

Name
python-oslo.messaging
Purl
pkg:deb/debian/python-oslo.messaging?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
14.0.3-0+deb12u1

Affected versions

14.*
14.0.0-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"

Debian:13 / python-oslo.messaging

Package

Name
python-oslo.messaging
Purl
pkg:deb/debian/python-oslo.messaging?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
16.1.0-3+deb13u1

Affected versions

16.*
16.1.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"

Debian:14 / python-oslo.messaging

Package

Name
python-oslo.messaging
Purl
pkg:deb/debian/python-oslo.messaging?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
17.3.0-4

Affected versions

16.*
16.1.0-3
17.*
17.1.0-1
17.1.0-2
17.1.0-3
17.3.0-1
17.3.0-2
17.3.0-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"