DEBIAN-CVE-2026-44393
An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not perform TLS hostname verification when connecting to the message broker. When ssl_ca_file is configured, the driver enables certificate chain validation but does not pass the expected broker hostname into the underlying TLS stack. Any certificate signed by the deployment CA is accepted regardless of hostname, allowing an attacker who can intercept control-plane traffic to impersonate the RabbitMQ broker and perform a man-in-the-middle attack on RPC and notification traffic. All OpenStack services using oslo.messaging with RabbitMQ over TLS are affected.
DEBIAN-CVE-2026-44393
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-44393
python-oslo.messaging
Source reference: /affected/0/package/name
- Affected versions
- 14.0.0-2
Source reference:
/affected/0/versions - Fixed versions
- 14.0.3-0+deb12u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
python-oslo.messaging
Source reference: /affected/1/package/name
- Affected versions
- 16.1.0-3
Source reference:
/affected/1/versions - Fixed versions
- 16.1.0-3+deb13u1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
python-oslo.messaging
Source reference: /affected/2/package/name
- Affected versions
- 16.1.0-3
Source reference:
/affected/2/versions17.1.0-1Source reference:
/affected/2/versions17.1.0-2Source reference:
/affected/2/versions17.1.0-3Source reference:
/affected/2/versions17.3.0-1Source reference:
/affected/2/versions17.3.0-2Source reference:
/affected/2/versions17.3.0-3Source reference:
/affected/2/versions - Fixed versions
- 17.3.0-4
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.0.3-0+deb12u1"
}
]
}
],
"package": {
"name": "python-oslo.messaging",
"purl": "pkg:deb/debian/python-oslo.messaging?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"14.0.0-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1.0-3+deb13u1"
}
]
}
],
"package": {
"name": "python-oslo.messaging",
"purl": "pkg:deb/debian/python-oslo.messaging?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"16.1.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "17.3.0-4"
}
]
}
],
"package": {
"name": "python-oslo.messaging",
"purl": "pkg:deb/debian/python-oslo.messaging?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"16.1.0-3",
"17.1.0-1",
"17.1.0-2",
"17.1.0-3",
"17.3.0-1",
"17.3.0-2",
"17.3.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44393.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #57127 · Revision 1
- Added to Heist Feed
- Publisher date