CVE-2017-2592 oslo.middleware Information Disclosure vulnerability
MediumCVSS 5.5
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oslo-middleware(PyPI) | >= 3.9.0, < 3.19.1 | 3.19.1 |
| pypi oslo-middleware(PyPI) | = 3.10.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.11.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.12.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.13.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.14.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.15.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.16.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.17.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.18.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.19.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.9.0 | No fix listed |
| pypi oslo-middleware(PyPI) | < 3.8.1 | 3.8.1 |
| pypi oslo-middleware(PyPI) | = 0.1.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 0.2.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 0.3.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 0.4.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 0.5.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 1.0.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 1.1.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 1.2.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 1.3.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.0.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.1.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.10.0 | No fix listed |
Show 34 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oslo-middleware(PyPI) | = 2.11.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.2.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.3.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.4.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.5.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.6.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.6.1 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.7.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.8.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 2.9.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.0.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.1.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.2.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.3.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.4.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.5.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.6.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.7.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.8.0 | No fix listed |
| pypi oslo-middleware(PyPI) | >= 3.20.0, < 3.23.1 | 3.23.1 |
| pypi oslo-middleware(PyPI) | = 3.20.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.21.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.22.0 | No fix listed |
| pypi oslo-middleware(PyPI) | = 3.23.0 | No fix listed |
| pypi oslo.middleware(PyPI) | < 3.8.1 | 3.8.1 |
| pypi oslo.middleware(PyPI) | >= 3.9.0, < 3.19.1 | 3.19.1 |
| pypi oslo.middleware(PyPI) | >= 3.20.0, < 3.23.1 | 3.23.1 |
| debian/python-oslo.middleware(Debian:12) | < 3.19.0-3 | 3.19.0-3 |
| debian/python-oslo.middleware(Debian:13) | < 3.19.0-3 | 3.19.0-3 |
| debian/python-oslo.middleware(Debian:14) | < 3.19.0-3 | 3.19.0-3 |
| OpenStack oslo.middleware | <= 3.8.0 | No fix listed |
| OpenStack oslo.middleware | >= 3.9.0, <= 3.19.0 | No fix listed |
| OpenStack oslo.middleware | >= 3.20.0, <= 3.23.0 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory vendor-advisory
- access.redhat.com third-party-advisory vendor-advisory
- bugs.launchpad.net issue-tracking patch third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com vendor-advisory
- github.com product
- github.com
- review.openstack.org issue-tracking patch vendor-advisory
- USN-3666-1 third-party-advisory vendor-advisory
- lists.openstack.org patch vendor-advisory
- RHSA-2017:0300 third-party-advisory vendor-advisory
- RHSA-2017:0435 third-party-advisory vendor-advisory
- 95827 third-party-advisory vdb-entry
- Debian Security Tracker CVE-2017-2592 vendor-advisory
- bugs.debian.org issue-tracking