Read the docs
TI-2017-01846 Aliases CVE-2017-2592GHSA-xcp8-hh74-f6mc

Sensitive information in log files in python-oslo-middleware

Priority LOW 27CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

Why it matters now

EPSS 0.00442 38th percentileScored 2026-11-07
Fix Fixed oslo.middleware (PyPI): 3.19.1, 3.8.1, 3.23.1oslo-middleware (PyPI): 3.19.1, 3.8.1, 3.23.1Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
unspecifiedpython-oslo-middlewarepython-oslo-middleware 3.8.1; python-oslo-middleware 3.19.1; python-oslo-middleware 3.23.1—No fix listedCNA
—oslo.middleware (PyPI)3.9.0 to before 3.19.13.19.1Patch availableGHSA-xcp8-hh74-f6mc
—oslo.middleware (PyPI)before 3.8.13.8.1Patch availableGHSA-xcp8-hh74-f6mc
—oslo.middleware (PyPI)3.20.0 to before 3.23.13.23.1Patch availableGHSA-xcp8-hh74-f6mc
—oslo-middleware (PyPI)3.9.0 to before 3.19.13.19.1Patch availableGHSA-xcp8-hh74-f6mc
—oslo-middleware (PyPI)before 3.8.13.8.1Patch availableGHSA-xcp8-hh74-f6mc
—oslo-middleware (PyPI)3.20.0 to before 3.23.13.23.1Patch availableGHSA-xcp8-hh74-f6mc
  • python-oslo-middleware Vendorunspecified Affected python-oslo-middleware 3.8.1; python-oslo-middleware 3.19.1; python-oslo-middleware 3.23.1 Fixed in — No fix listed CNA
  • oslo.middleware (PyPI) Vendor— Affected 3.9.0 to before 3.19.1 Fixed in 3.19.1 Patch available GHSA-xcp8-hh74-f6mc
  • oslo.middleware (PyPI) Vendor— Affected before 3.8.1 Fixed in 3.8.1 Patch available GHSA-xcp8-hh74-f6mc
  • oslo.middleware (PyPI) Vendor— Affected 3.20.0 to before 3.23.1 Fixed in 3.23.1 Patch available GHSA-xcp8-hh74-f6mc
  • oslo-middleware (PyPI) Vendor— Affected 3.9.0 to before 3.19.1 Fixed in 3.19.1 Patch available GHSA-xcp8-hh74-f6mc
  • oslo-middleware (PyPI) Vendor— Affected before 3.8.1 Fixed in 3.8.1 Patch available GHSA-xcp8-hh74-f6mc
  • oslo-middleware (PyPI) Vendor— Affected 3.20.0 to before 3.23.1 Fixed in 3.23.1 Patch available GHSA-xcp8-hh74-f6mc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:oslo.middleware:*:*:*:*:*:*:*:*up to 3.8.0; 3.9.0 – 3.19.0; 3.20.0 – 3.23.0VulnerableOpenStack
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
  • cpe:2.3:a:openstack:oslo.middleware:*:*:*:*:*:*:*:* Versions up to 3.8.0; 3.9.0 – 3.19.0; 3.20.0 – 3.23.0 Vulnerable ·OpenStack
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-xcp8-hh74-f6mc oslo.middleware (PyPI) Fixed in 3.19.1 Advisory →
  • Fix · GHSA-xcp8-hh74-f6mc oslo.middleware (PyPI) Fixed in 3.8.1 Advisory →
  • Fix · GHSA-xcp8-hh74-f6mc oslo.middleware (PyPI) Fixed in 3.23.1 Advisory →
  • Fix · GHSA-xcp8-hh74-f6mc oslo-middleware (PyPI) Fixed in 3.19.1 Advisory →
  • Fix · GHSA-xcp8-hh74-f6mc oslo-middleware (PyPI) Fixed in 3.8.1 Advisory →
  • Fix · GHSA-xcp8-hh74-f6mc oslo-middleware (PyPI) Fixed in 3.23.1 Advisory →

Red Hat 2 advisories

  • RHSA-2017:0435 Released 2017-03-02 · Red Hat rating Moderate
    python-oslo-middleware security update
    • Red Hat OpenStack Platform 9.0 python-oslo-middleware-3.7.0-2.el7ost, python-oslo-middleware-tests-3.7.0-2.el7ost
  • RHSA-2017:0300 Released 2017-02-22 · Red Hat rating Moderate
    python-oslo-middleware security update
    • Red Hat OpenStack Platform 10.0 python-oslo-middleware-3.19.0-1.2.el7ost, python-oslo-middleware-lang-3.19.0-1.2.el7ost, python-oslo-middleware-tests-3.19.0-1.2.el7ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10.0Fixed RHSA-2017:0300
Red Hat OpenStack Platform 9.0Fixed RHSA-2017:0435
Not affected: 6 products
  • Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
  • Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
  • Red Hat OpenStack Platform 11 (Ocata)
  • Red Hat OpenStack Platform 8 (Liberty)
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-2592
  2. 2026-10-03 Alias added: GHSA-xcp8-hh74-f6mc

References

Patch 6

Advisory 7

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences