GHSA-xcp8-hh74-f6mcHighCVSS 5.5

oslo.middleware Information Disclosure vulnerability

Published
July 13, 2018
Last Modified
October 7, 2024

🔗 CVE IDs covered (1)

CVE-2017-2592 →

📋 Description

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

🎯 Affected products6

  • pip/oslo.middleware:< 3.8.1
  • pip/oslo.middleware:>= 3.9.0, < 3.19.1
  • pip/oslo.middleware:>= 3.20.0, < 3.23.1
  • pip/oslo-middleware:>= 3.9.0, < 3.19.1
  • pip/oslo-middleware:>= 0, < 3.8.1
  • pip/oslo-middleware:>= 3.20.0, < 3.23.1

🔗 References (14)