CVE-2017-2592
Medium
Description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
SeverityMedium
CVSS5.9
Exploit probability—
ProductOslo-middleware
PublishedMay 8, 2018
First seenMay 8, 2018
Weakness typeCWE-532CWE-532
How to fix
Update
- oslo-middleware3.19.1, 3.8.1, 3.23.1 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oslo-middlewarePyPI | 3.9.0 ≤ v < 3.19.1, v < 3.8.1, 3.20.0 ≤ v < 3.23.1 | 3.19.1, 3.8.1, 3.23.1 |
| openstack oslo.middleware | v ≤ 3.8.0, 3.9.0 ≤ v ≤ 3.19.0, 3.20.0 ≤ v ≤ 3.23.0 | — |
| canonical ubuntu_linux | 16.04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.