CVE-2017-2592

low-risk
Published 2018-05-08

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Oslo.Middleware

Affected Vendors

Canonical Openstack

References (24)

Patch http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0300.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0435.html
Third Party Advisory http://www.securityfocus.com/bid/95827
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0300
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0435
Issue Tracking https://bugs.launchpad.net/keystonemiddleware/+bug/1628031
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592
Issue Tracking https://review.openstack.org/#/c/425730/
Issue Tracking https://review.openstack.org/#/c/425732/
Issue Tracking https://review.openstack.org/#/c/425734/
Third Party Advisory https://usn.ubuntu.com/3666-1/
Patch http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0300.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2017-0435.html
Third Party Advisory http://www.securityfocus.com/bid/95827
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0300
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:0435
Issue Tracking https://bugs.launchpad.net/keystonemiddleware/+bug/1628031
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592
and 4 more references
26
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low