Medium severity · published Dec 12, 2017
CVE-2017-12155
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Ceph · Ceph
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12155
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:0602
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:1593
access.redhat.com
https://access.redhat.com/errata/RHSA-2018:1627
Issue Tracking
https://bugs.launchpad.net/tripleo/+bug/1720787
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1489360
More from Ceph
9.1
CVE-2026-50152
Ceph Monitor subscription handler improperly authorizes config-key store reads, exposing cluster secrets to read-only users
8.9
CVE-2025-30156
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
8.8
CVE-2026-39944
Ceph: CephX AES Authentication error
8.1
CVE-2026-54330
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
8.1
CVE-2018-10861
A flaw was found in the way ceph mon handles user requests