PT-2018-7122 · Openstack+1 · Python-Oslo-Middleware+1

Divya K Konoor · Publicado 2017-03-29 · Atualizado 2019-10-09 · CVE-2017-2592

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: python-oslo-middleware versions prior to 3.8.1, 3.19.1, 3.23.1

Description: The issue allows system users to obtain sensitive information from OpenStack component error logs, such as keystone tokens, by exploiting a flaw in the CatchError class. This class could include sensitive values in a traceback's error message, leading to an information disclosure.

Recommendations: For versions prior to 3.8.1, update to version 3.8.1 or later. For versions prior to 3.19.1, update to version 3.19.1 or later. For versions prior to 3.23.1, update to version 3.23.1 or later.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-2592

GHSA-XCP8-HH74-F6MC

PYSEC-2018-104

RHSA-2017:0300

RHSA-2017:0435

SUSE-SU-2017:0848-1

SUSE-SU-2017:1062-1

SUSE-SU-2018:3924-1

USN-3666-1

Produtos afetados

Ubuntu

Python-Oslo-Middleware

Referências · 37

• https://github.com/pypa/advisory-database/tree/main/vulns/oslo-middleware/PYSEC-2018-104.yaml · Nota
• https://github.com/openstack/oslo.middleware · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592 · Correção
• https://review.openstack.org/#/c/425732 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:0435 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:1062-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-2592 · Nota de Segurança
• https://usn.ubuntu.com/3666-1 · Aviso do Fabricante
• http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2592 · Nota de Segurança
• https://bugs.launchpad.net/keystonemiddleware/+bug/1628031 · Correção
• https://review.openstack.org/#/c/425734 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2017-0300.html · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2592 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2592 · Aviso do Fabricante