GitHub Advisoryadvisory · PyPI

GHSA-xcp8-hh74-f6mc oslo.middleware Information Disclosure vulnerability

HIGH Published 2018-07-13 Modified 2024-10-07 Official page ↗
Aliases
CVE-2017-2592
Ecosystem
PyPI
Packages
oslo.middleware, oslo-middleware
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2020-06-16

Affected packages

• PyPI oslo.middleware: >= 3.9.0, < 3.19.1 → fixed in 3.19.1 • PyPI oslo.middleware: < 3.8.1 → fixed in 3.8.1 • PyPI oslo.middleware: >= 3.20.0, < 3.23.1 → fixed in 3.23.1 • PyPI oslo-middleware: >= 3.9.0, < 3.19.1 → fixed in 3.19.1 • PyPI oslo-middleware: < 3.8.1 → fixed in 3.8.1 • PyPI oslo-middleware: >= 3.20.0, < 3.23.1 → fixed in 3.23.1

Description

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

Related

Alias · CVE (1)

  • CVE-2017-2592 python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References