Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu Cloud 18.04.1 CVE-2021-1234 High Buffer Overflow Risk

red hat
Calendar Grey February 22, 2017
Scroller Redhat
A recent patch for python-oslo-middleware resolves a significant vulnerability in Red Hat OpenStack Platform 10.0.
An update for python-oslo-middleware is now available for Red Hat OpenStack Platform 10.0 (Newton)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The OpenStack Oslo Middleware library provides components that can be injected into WSGI pipelines to intercept request and response flows. The base class can be enhanced with functionality like adding or updating HTTP headers, or to offer support for limiting size or connections.
Security Fix(es):
* An information-disclosure flaw was found in oslo.middleware. Software using the CatchError class could include sensitive values in a traceback's error message. Remote users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens). (CVE-2017-2592)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Divya K Konoor (IBM) as the original reporter.

Topics%20covered

Topics Covered

security advisory moderate info leak Red Hat OpenStack python-oslo-middleware

References

https://access.redhat.com/security/cve/CVE-2017-2592 https://access.redhat.com/security/updates/classification#moderate

Package List

Red Hat OpenStack Platform 10.0:
Source: python-oslo-middleware-3.19.0-1.2.el7ost.src.rpm
noarch: python-oslo-middleware-3.19.0-1.2.el7ost.noarch.rpm python-oslo-middleware-lang-3.19.0-1.2.el7ost.noarch.rpm python-oslo-middleware-tests-3.19.0-1.2.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2017:0300-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0300.html
Issue date: 2017-02-22

Topic

An update for python-oslo-middleware is now available for Red Hat OpenStackPlatform 10.0 (Newton).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate info leak Red Hat OpenStack python-oslo-middleware

Relevant Releases Architectures

Red Hat OpenStack Platform 10.0 - noarch

Bugs Fixed

1414698 - CVE-2017-2592 python-oslo-middleware: CatchErrors leaks sensitive values into error logs

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.