python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
References
| Link | Resource |
|---|---|
| https://review.openstack.org/#/c/425734/ | Issue Tracking Patch Vendor Advisory |
| https://review.openstack.org/#/c/425732/ | Issue Tracking Patch Vendor Advisory |
| https://review.openstack.org/#/c/425730/ | Issue Tracking Patch Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592 | Issue Tracking Patch Third Party Advisory |
| https://bugs.launchpad.net/keystonemiddleware/+bug/1628031 | Issue Tracking Patch Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2017:0435 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2017:0300 | Third Party Advisory |
| http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html | Patch Vendor Advisory |
| http://www.securityfocus.com/bid/95827 | Third Party Advisory VDB Entry |
| http://rhn.redhat.com/errata/RHSA-2017-0435.html | Third Party Advisory |
| http://rhn.redhat.com/errata/RHSA-2017-0300.html | Third Party Advisory |
| https://usn.ubuntu.com/3666-1/ | Third Party Advisory |
Advertisement
Information
Published : 2018-05-08 10:29
Updated : 2019-10-09 16:26
NVD link : CVE-2017-2592
Mitre link : CVE-2017-2592
JSON object : View
CWE
CWE-532
Insertion of Sensitive Information into Log File
Advertisement
Products Affected
canonical
- ubuntu_linux
openstack
- oslo.middleware