CVE-2017-2592

Information disclosure in python-oslo-middleware <3.8.1, 3.19.1, 3.23.1

• CVSS 5.5
• CWE-532 Insertion of Sensitive Information into Log File
• Information Leakage
• Remote

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).

CVE

CVE-2017-2592

CWE

CWE-532 Insertion of Sensitive Information into Log File

CVSS base score

5.5

Published

2018-05-08

OWASP

A09 Security Logging and Monitoring Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Fixed by upgrading

Yes

Solution

Update python-oslo-middleware to version 3.8.1, 3.19.1, or 3.23.1 or higher.

import logging
from oslo_middleware import catch_error

class ExampleCatchError(catch_error.CatchError):
    def __init__(self, *args, **kwargs):
        super(ExampleCatchError, self).__init__(*args, **kwargs)

    def __call__(self, environ, start_response):
        try:
            return super(ExampleCatchError, self).__call__(environ, start_response)
        except Exception as e:
            logging.error("An error occurred: %s", str(e), exc_info=True)
            start_response('500 Internal Server Error', [('Content-Type', 'text/plain')])
            return [str(e).encode('utf-8')]

import logging
from oslo_middleware import catch_error

logger = logging.getLogger(__name__)

class ExampleCatchError(catch_error.CatchError):
    def __init__(self, *args, **kwargs):
        super(ExampleCatchError, self).__init__(*args, **kwargs)

    def __call__(self, environ, start_response):
        try:
            return super(ExampleCatchError, self).__call__(environ, start_response)
        except Exception as e:
            logger.error("Unhandled exception occurred", exc_info=True)
            start_response('500 Internal Server Error', [('Content-Type', 'text/plain; charset=utf-8')])
            return [b"An internal server error occurred. Please try again later."]

@misc{vaitp:cve20172592,
  title        = {{Information disclosure in python-oslo-middleware <3.8.1, 3.19.1, 3.23.1}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2018},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2017-2592},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-2592/}}
}