CVE-2017-15139

HIGH

Openstack Cinder < 12.0.4-7 - Information Disclosure

Title source: rule

Description

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

References (4)

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2018:3601

[Third Party Advisory] https://access.redhat.com/errata/RHSA-2019:0917

[Issue Tracking, Patch, Third Party Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139

[Mitigation, Third Party Advisory] https://wiki.openstack.org/wiki/OSSN/OSSN-0084

Scores

CVSS v3 7.5

EPSS 0.0024

EPSS Percentile 47.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (3)

openstack/cinder < 12.0.4-7

redhat/openstack

redhat/openstack

Timeline

Published Aug 27, 2018

Tracked Since Feb 18, 2026