Description
python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | python-oslo-middleware | python-oslo-middleware 3.8.1, python-oslo-middleware 3.19.1, python-oslo-middleware 3.23.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-oslo.middleware | 3.19.0-3 | — |
| Debian 13 | python-oslo.middleware | 3.19.0-3 | — |
| Debian 12 | python-oslo.middleware | 3.19.0-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-oslo.middleware | 3.8.0-2ubuntu1 | USN-3666-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | python-oslo-middleware +2 | 3.19.0-1.2.el7ost | RHSA-2017:0300 |
| Red Hat OpenStack 9 | python-oslo-middleware +1 | 3.7.0-2.el7ost | RHSA-2017:0435 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | python-oslo.cache | 1.14.1-3.3.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.concurrency | 3.14.1-3.3.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.db | 4.13.6-3.3.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.log +1 | 3.16.1-3.3.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.messaging | 5.10.2-3.6.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.middleware | 3.19.0-3.1 | SUSE-SU-2018:3924-1, SUSE-SU-2017:1062-1 |
| SUSE OpenStack Cloud 7 | python-oslo.serialization | 2.13.2-3.3.3 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.service | 1.16.1-3.3.1 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.versionedobjects | 1.17.1-3.3.1 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslo.vmware | 2.14.1-3.3.1 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 7 | python-oslotest | 2.10.1-3.3.1 | SUSE-SU-2018:3924-1 |
| SUSE OpenStack Cloud 6 | python-oslo.middleware | 2.8.0-3.1 | SUSE-SU-2017:0848-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | oslo-middleware | >= 3.9.0, < 3.19.1 | 3.19.1 | GHSA-xcp8-hh74-f6mc |
| PyPI | oslo-middleware | < 3.8.1 | 3.8.1 | GHSA-xcp8-hh74-f6mc |
| PyPI | oslo-middleware | >= 3.20.0, < 3.23.1 | 3.23.1 | GHSA-xcp8-hh74-f6mc |
| PyPI | oslo-middleware | >= 3.9.0, < 3.19.1 · < 3.8.1 · >= 3.20.0, < 3.23.1 | 3.19.1, 3.8.1, 3.23.1 | PYSEC-2018-104 |
Advisories 6
- RHSA-2017:0300 Red Hat Security Advisory: python-oslo-middleware security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2017:0435 Red Hat Security Advisory: python-oslo-middleware security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3666-1 python-oslo.middleware vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2017:1062-1 Security update for python-oslo.middleware SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3924-1 Security update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0848-1 Security update for python-oslo.middleware SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://review.openstack.org/#/c/425732/
- http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html
- RHSA-2017:0300 vendor-advisory
- https://access.redhat.com/errata/RHSA-2017:0300
- RHSA-2017:0435 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592
- 95827 vdb-entry
- https://review.openstack.org/#/c/425730/
- https://review.openstack.org/#/c/425734/
- https://bugs.launchpad.net/keystonemiddleware/+bug/1628031
- https://access.redhat.com/errata/RHSA-2017:0435
- USN-3666-1 vendor-advisory