CVE-2017-2592CWE-532

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure

Medium · published May 8, 2018

CVSS v3.0
5.9
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

The record
Technical detail
CVSS v3.0
5.9 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.1th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2018-05-08T17:00Z
EPSS history
Timeline
  • 08 MAY 17:00Z
    python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure
    cvelistv5