CVE-2017-2592 oslo.middleware Information Disclosure vulnerability
Attackers can obtain sensitive information, such as keystone tokens, from OpenStack error logs due to improper handling of tracebacks in the CatchError class.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-2592?
CVE-2017-2592 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 8 May 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Weakness: CWE-532
Which versions are affected by CVE-2017-2592?
10 open source packages ship an affected version, including oslo-middleware and oslo.middleware. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
oslo-middleware PyPI | All versions | 3.8.1 |
oslo-middleware PyPI | All versions | 3.8.1 |
oslo-middleware PyPI | From 3.20.0 | 3.23.1 |
oslo-middleware PyPI | From 3.20.0 | 3.23.1 |
oslo-middleware PyPI | From 3.9.0 | 3.19.1, 3.8.1, 3.23.1 |
oslo-middleware PyPI | From 3.9.0 | 3.19.1 |
4 more packages
oslo-middleware PyPI | From 3.9.0 | 3.19.1 |
oslo.middleware PyPI | All versions | 3.8.1 |
oslo.middleware PyPI | From 3.20.0 | 3.23.1 |
oslo.middleware PyPI | From 3.9.0 | 3.19.1 |
Linux distribution packages (19)
python-oslo-middleware Red Hat:openstack:10::el7 | All versions | 0:3.19.0-1.2.el7ost |
python-oslo-middleware-lang Red Hat:openstack:10::el7 | All versions | 0:3.19.0-1.2.el7ost |
python-oslo-middleware-tests Red Hat:openstack:10::el7 | All versions | 0:3.19.0-1.2.el7ost |
python-oslo-middleware Red Hat:openstack:9::el7 | All versions | 0:3.7.0-2.el7ost |
python-oslo-middleware-tests Red Hat:openstack:9::el7 | All versions | 0:3.7.0-2.el7ost |
python-oslo.middleware SUSE:OpenStack Cloud 6 | All versions | 2.8.0-3.1 |
python-oslo.cache SUSE:OpenStack Cloud 7 | All versions | 1.14.1-3.3.3 |
python-oslo.concurrency SUSE:OpenStack Cloud 7 | All versions | 3.14.1-3.3.3 |
python-oslo.db SUSE:OpenStack Cloud 7 | All versions | 4.13.6-3.3.3 |
python-oslo.log SUSE:OpenStack Cloud 7 | All versions | 3.16.1-3.3.3 |
python-oslo.messaging SUSE:OpenStack Cloud 7 | All versions | 5.10.2-3.6.3 |
python-oslo.middleware SUSE:OpenStack Cloud 7 | All versions | 3.19.0-3.1 |
python-oslo.middleware SUSE:OpenStack Cloud 7 | All versions | 3.19.1-4.3.4 |
python-oslo.serialization SUSE:OpenStack Cloud 7 | All versions | 2.13.2-3.3.3 |
python-oslo.service SUSE:OpenStack Cloud 7 | All versions | 1.16.1-3.3.1 |
python-oslo.utils SUSE:OpenStack Cloud 7 | All versions | 3.16.1-3.3.3 |
python-oslo.versionedobjects SUSE:OpenStack Cloud 7 | All versions | 1.17.1-3.3.1 |
python-oslo.vmware SUSE:OpenStack Cloud 7 | All versions | 2.14.1-3.3.1 |
python-oslotest SUSE:OpenStack Cloud 7 | All versions | 2.10.1-3.3.1 |
Products include Canonical Ubuntu Linux, Openstack Oslo.middleware.
How do I fix CVE-2017-2592?
Upgrade oslo-middleware to a fixed version for your release line: 3.8.1, 3.23.1 or 3.19.1.
Is CVE-2017-2592 being exploited?
There is no known exploitation of CVE-2017-2592 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2017-2592, GHSA-xcp8-hh74-f6mc, PYSEC-2018-104, RHSA-2017:0300, RHSA-2017:0435, SUSE-SU-2017:0848-1 and 4 more.