[Openstack] [OSSA-2017-001] CatchErrors leaks sensitive values in oslo.middleware (CVE-2017-2592)

Jeremy Stanley fungi at yuggoth.org
Thu Jan 26 20:25:01 UTC 2017

OSSA-2017-001: CatchErrors leaks sensitive values in oslo.middleware

:Date: January 26, 2017
:CVE: CVE-2017-2592

- Oslo.middleware: <=3.8.0, >=3.9.0 <=3.19.0, >=3.20.0 <=3.23.0

Divya K Konoor with IBM reported a vulnerability in oslo.middleware.
Software using the CatchError class may include sensitive values in
the error message accompanying a Traceback, resulting in their
disclosure. For example, complete API requests (including keystone
tokens in their headers) may leak into neutron error logs.

- https://review.openstack.org/425734 (Mitaka)
- https://review.openstack.org/425732 (Newton)
- https://review.openstack.org/425730 (Ocata)

- Divya K Konoor from IBM (CVE-2017-2592)

- https://launchpad.net/bugs/1628031
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2592

Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 949 bytes
Desc: Digital signature
URL: <http://lists.openstack.org/pipermail/openstack/attachments/20170126/c6523f5f/attachment.sig>

More information about the Openstack mailing list