python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure.
    Software using the CatchError class could include sensitive values in a traceback's error message. System
    users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for
    example, keystone tokens). (CVE-2017-2592)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:0300 advisory.

    The OpenStack Oslo Middleware library provides components that can be injected into WSGI pipelines to     intercept request and response flows. The base class can be enhanced with functionality like adding or     updating HTTP headers, or to offer support for limiting size or connections.

    Security Fix(es):

    * An information-disclosure flaw was found in oslo.middleware. Software using the CatchError class could     include sensitive values in a traceback's error message. Remote users could exploit this flaw to obtain     sensitive information from OpenStack component error logs (for example, keystone tokens). (CVE-2017-2592)

    Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Divya K     Konoor (IBM) as the original reporter.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3666-1 advisory.

    Divya K Konoor discovered Oslo middleware was vulnerable to an information disclosure. A local attacker     could exploit this flaw to obtain sensitive information from OpenStack component error logs.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423268	SCA: security update for oslo-middleware, oslo.middleware (GHSA-xcp8-hh74-f6mc)	Tenable Cloud Security	SCA Checks	high
423268	SCA: security update for oslo-middleware, oslo.middleware (GHSA-xcp8-hh74-f6mc)	Tenable Self-Hosted Container Security	SCA Checks	high
210194	RHEL 7 : python-oslo-middleware (RHSA-2017:0300)	Nessus	Red Hat Local Security Checks	medium
110285	Ubuntu 16.04 LTS : Oslo middleware vulnerability (USN-3666-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2017-2592

high

Tenable Plugins

high

high

medium

medium