Security Bulletin: IBM PowerVC is impacted by python oslo.middleware package information disclosure (CVE-2017-2592)

Summary

IBM PowerVC may disclose some sensitive values in an error message.

Vulnerability Details

CVEID: CVE-2017-2592**
DESCRIPTION:** The OpenStack python oslo.middleware package could allow a local authenticated attacker to obtain sensitive information by including sensitive data in the CatchError class. A local attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/123956 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N)

Affected Products and Versions

PowerVC Standard Edition 1.3.1.x

Remediation/Fixes

For PowerVC 1.3.1, update to 1.3.1 fix pack 2 and then apply the IT21367_IT21368_IT21369 interim fix from FixCentral: http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FPowerVC&fixids=1.3.1.2-PowerVC-RHEL-NOARCH-APAR-IT21367_IT21368_IT21369&source=dbluesearch

Workarounds and Mitigations

None