[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20170126202602.GZ12842@openstack.org>
Date: Thu, 26 Jan 2017 20:26:02 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: [OSSA-2017-001] CatchErrors leaks sensitive values in
oslo.middleware (CVE-2017-2592)
====================================================================
OSSA-2017-001: CatchErrors leaks sensitive values in oslo.middleware
====================================================================
:Date: January 26, 2017
:CVE: CVE-2017-2592
Affects
~~~~~~~
- Oslo.middleware: <=3.8.0, >=3.9.0 <=3.19.0, >=3.20.0 <=3.23.0
Description
~~~~~~~~~~~
Divya K Konoor with IBM reported a vulnerability in oslo.middleware.
Software using the CatchError class may include sensitive values in
the error message accompanying a Traceback, resulting in their
disclosure. For example, complete API requests (including keystone
tokens in their headers) may leak into neutron error logs.
Patches
~~~~~~~
- https://review.openstack.org/425734 (Mitaka)
- https://review.openstack.org/425732 (Newton)
- https://review.openstack.org/425730 (Ocata)
Credits
~~~~~~~
- Divya K Konoor from IBM (CVE-2017-2592)
References
~~~~~~~~~~
- https://launchpad.net/bugs/1628031
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2592
--
Jeremy Stanley
OpenStack Vulnerability Management Team
Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
