Information disclosure in OpenStack Cinder
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
Vulnerability class: Information Disclosure
EPSS: 0.012 (67.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Openstack Cinder
- Openstack Foundation Openstack-cinder — versions up to and including Queens
- Redhat Openstack — versions 10, 13
Weakness classification (CWE)
References
- secalert@redhat.com (Third Party Advisory, x_refsource_MISC, Mitigation)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-15139?
- CVE-2017-15139 is a high-severity vulnerability in OpenStack Cinder, classified under Information Disclosure. CVSS score: 7.5/10. Published 2018-08-27.
- How severe is CVE-2017-15139?
- High severity. CVSS v3 base score is 7.5 out of 10.