High severity · published Aug 27, 2018
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cinder · Openstack
through 12.0.4-7 · source: NVD
OP
Openstack · Redhat
10; 13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15139
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15139
Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3601
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0917
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139
Mitigation
https://wiki.openstack.org/wiki/OSSN/OSSN-0084
More from Cinder
7.5
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
6.5
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
5.7
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x…
4.3
CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API
–
CVE-2014-7231
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when…