CVE-2017-2592

Name: CVE-2017-2592
Creator: NVD / NIST
Published: 2018-05-08T17:29:00.56+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 0.47%

Last modified Jun 17, 2026

CVE-2017-2592 is a vulnerability of currently unknown severity. python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. EPSS estimates a 0.47% chance of exploitation in the next 30 days.

Description

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

Metrics

EPSS Probability

0.47%

36.9th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Openstack	Oslo.Middleware	<= 3.8.0
Openstack	Oslo.Middleware	>= 3.9.0, <= 3.19.0
Openstack	Oslo.Middleware	>= 3.20.0, <= 3.23.0
Canonical	Ubuntu Linux	16.04

References

http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0300.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0435.htmlThird Party Advisory
http://www.securityfocus.com/bid/95827Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0300Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0435Third Party Advisory
https://bugs.launchpad.net/keystonemiddleware/+bug/1628031Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592Issue Tracking, Patch, Third Party Advisory
https://review.openstack.org/#/c/425730/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/425732/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/425734/Issue Tracking, Patch, Vendor Advisory
https://usn.ubuntu.com/3666-1/Third Party Advisory
http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0300.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0435.htmlThird Party Advisory
http://www.securityfocus.com/bid/95827Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0300Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0435Third Party Advisory
https://bugs.launchpad.net/keystonemiddleware/+bug/1628031Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592Issue Tracking, Patch, Third Party Advisory
https://review.openstack.org/#/c/425730/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/425732/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/425734/Issue Tracking, Patch, Vendor Advisory
https://usn.ubuntu.com/3666-1/Third Party Advisory

Timeline

Published: May 8, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-2592?

How severe is CVE-2017-2592?

Severity scoring for CVE-2017-2592 is pending analysis. The EPSS model estimates a 0.47% probability of exploitation in the next 30 days.

How do I fix CVE-2017-2592?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-2592?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST