CVSS 3.0
5.5 mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVE-2017-2592
Medium (5.5). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in oslo-middleware 3.19.1, 3.23.1, 3.8.1.
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 38% of CVEs (scores of 2026-10-31)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- openstack:oslo.middleware
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | >=3.9.0 <3.19.1 | 3.19.1 |
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | <3.8.1 | 3.8.1 |
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | >=3.20.0 <3.23.1 | 3.23.1 |
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | >=3.9.0 <3.19.1 | 3.19.1 |
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | <3.8.1 | 3.8.1 |
| GHSA-xcp8-hh74-f6mc | PyPI | oslo-middleware | >=3.20.0 <3.23.1 | 3.23.1 |
| PYSEC-2018-104 | PyPI | oslo-middleware | >=3.9.0 <3.19.1 <3.8.1 >=3.20.0 <3.23.1 | 3.19.1, 3.8.1, 3.23.1 |