CVE-2017-2592: Information Disclosure in oslo-middleware
Summary
CVE-2017-2592: python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Affects oslo-middleware across 3 version ranges.
< 3.8.1
>= 3.9.0, < 3.19.1
>= 3.20.0, < 3.23.1
Fixed in 3.8.1, 3.19.1 or 3.23.1, depending on the release line you run. How to fix ↓
Also tracked for
- python-oslo.middleware · Debian:11
The same CVE-2017-2592 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oslo-middleware is a Python package available on PyPI that provides middleware components for OpenStack services. It is commonly used in OpenStack deployments to handle various tasks such as request processing, error handling, and authentication. This vulnerability affects versions prior to 3.8.1, 3.19.1, and 3.23.1 of oslo-middleware.
Vulnerability Detail
The vulnerability identified as CVE-2017-2592 allows for information disclosure in oslo-middleware. Specifically, the CatchError class in the software could include sensitive values in a traceback's error message. This flaw can be exploited by system users to obtain sensitive information from OpenStack component error logs, including potentially sensitive data like keystone tokens. This could lead to unauthorized access and compromise of the affected system.
How To Fix
Latest published version: 8.2.0 as of 23 Oct 2026
pip install --upgrade "oslo-middleware==8.2.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.8.13.8.1pip install --upgrade "oslo-middleware==3.8.1" -
>= 3.9.0, < 3.19.13.19.1pip install --upgrade "oslo-middleware==3.19.1" -
>= 3.20.0, < 3.23.13.23.1pip install --upgrade "oslo-middleware==3.23.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to a fixed version is the recommended solution.
Conclusion
The vulnerability identified as CVE-2017-2592 in oslo-middleware allows for information disclosure, potentially leading to unauthorized access and compromise of the affected system. Users are advised to upgrade to a fixed version of oslo-middleware (3.8.1, 3.19.1, or 3.23.1) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oslo-middleware →
FAQ
oslo-middleware is a Python package that provides middleware components for OpenStack services. It is commonly used in OpenStack deployments to handle various tasks such as request processing, error handling, and authentication.
This vulnerability allows system users to obtain sensitive information from OpenStack component error logs, potentially including keystone tokens. This could lead to unauthorized access and compromise of the affected system.
Versions prior to 3.8.1, 3.19.1, and 3.23.1 of oslo-middleware are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to a fixed version of oslo-middleware. The issue has been addressed in versions 3.8.1, 3.19.1, and 3.23.1.
There is no specific workaround provided for this vulnerability. Upgrading to a fixed version is the recommended solution.
