CVE-2017-15139
Last modified
CVE-2017-15139 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. EPSS estimates a 1.24% chance of exploitation in the next 30 days.
Description
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Cinder | <= 12.0.4-7 |
| Redhat | Openstack | 10 |
| Redhat | Openstack | 13 |
References
- https://access.redhat.com/errata/RHSA-2018:3601Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0917Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139Issue Tracking, Patch, Third Party Advisory
- https://wiki.openstack.org/wiki/OSSN/OSSN-0084Mitigation, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2018:3601Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0917Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139Issue Tracking, Patch, Third Party Advisory
- https://wiki.openstack.org/wiki/OSSN/OSSN-0084Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15139?
How severe is CVE-2017-15139?
How do I fix CVE-2017-15139?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-15133A denial of service flaw was found in miekg-dns before 1.0.4…
- CVE-2017-15134A stack buffer overflow flaw was found in the way 389-ds-bas…
- CVE-2017-15135It was found that 389-ds-base since 1.3.6.1 up to and includ…
- CVE-2017-15136When registering and activating a new system with Red Hat Sa…
- CVE-2017-15137The OpenShift image import whitelist failed to enforce restr…4.3
- CVE-2017-15138The OpenShift Enterprise cluster-read can access webhook tok…5
- CVE-2017-15140Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15141Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15142Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15143Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15144Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15145Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
Are you affected by CVE-2017-15139?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST