En bref
- CVE-2017-2592 est une vulnérabilité MOYENNE (CVSS 5.5) touchant oslo-middleware, oslo.middleware (openstack).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.44%, plus élevée que 38.4% des vulnérabilités.
- Correctif : mettre à jour vers 3.23.1, 3.19.1, 3.8.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| oslo-middleware PyPI | ≥ 3.20.0, < 3.23.1≥ 3.9.0, < 3.19.1< 3.8.1
| 3.23.13.19.13.8.1
|
| oslo.middleware | ≥ 3.20.0, ≤ 3.23.0≥ 3.9.0, ≤ 3.19.0≤ 3.8.0
| No fix yet |
Description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
NVD description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free