CVE-2017-2592: oslo.middleware Information Disclosure vulnerability
(updated )
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback’s error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
References
- access.redhat.com/errata/RHSA-2017:0300
- access.redhat.com/errata/RHSA-2017:0435
- bugs.launchpad.net/keystonemiddleware/+bug/1628031
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592
- github.com/advisories/GHSA-xcp8-hh74-f6mc
- github.com/openstack/oslo.middleware
- github.com/pypa/advisory-database/tree/main/vulns/oslo-middleware/PYSEC-2018-104.yaml
- nvd.nist.gov/vuln/detail/CVE-2017-2592
- review.openstack.org/
- review.openstack.org/
- review.openstack.org/
- usn.ubuntu.com/3666-1
Code Behaviors & Features
Detect and mitigate CVE-2017-2592 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →