Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu Cloud 4.0 USN-2017-3434-01 Moderate Vulnerability Report Overview

red hat
Calendar Grey March 2, 2017
Scroller Redhat
A moderate patch has been released for python-oslo-middleware within Red Hat OpenStack Platform version 9.0, addressing a vulnerability that could lead to information exposure.
An update for python-oslo-middleware is now available for Red Hat OpenStack Platform 9.0 (Mitaka)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

The OpenStack Oslo Middleware library provides components that can be injected into WSGI pipelines to intercept request and response flows. The base class can be enhanced with functionality like adding or updating HTTP headers, or to offer support for limiting size or connections.
Security Fix(es):
* An information-disclosure flaw was found in oslo.middleware. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens). (CVE-2017-2592)
Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Divya K Konoor (IBM) as the original reporter.

Topics%20covered

Topics Covered

security advisory moderate severity info leak red hat openstack oslo middleware

References

https://access.redhat.com/security/cve/CVE-2017-2592 https://access.redhat.com/security/updates/classification/#moderate

Package List

Red Hat OpenStack Platform 9.0:
Source: python-oslo-middleware-3.7.0-2.el7ost.src.rpm
noarch: python-oslo-middleware-3.7.0-2.el7ost.noarch.rpm python-oslo-middleware-tests-3.7.0-2.el7ost.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2017:0435-01
Product: Red Hat Enterprise Linux OpenStack Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:0435.html
Issue date: 2017-03-02

Topic

An update for python-oslo-middleware is now available for Red Hat OpenStackPlatform 9.0 (Mitaka).Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate severity info leak red hat openstack oslo middleware

Relevant Releases Architectures

Red Hat OpenStack Platform 9.0 - noarch

Bugs Fixed

1414698 - CVE-2017-2592 python-oslo-middleware: CatchErrors leaks sensitive values into error logs

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.