CVE-2017-12155
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
- Record
CVE-2017-12155- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
CVE List No score
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
- Record
CVE-2017-12155- Updated
- 2026-11-02
EUVDEUVD-2022-5532 No score
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
- Record
EUVD-2022-5532- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8gx-hhcx-px6w
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
- Record
GHSA-w8gx-hhcx-px6w- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVGHSA-w8gx-hhcx-px6w
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
- Record
GHSA-w8gx-hhcx-px6w- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVPYSEC-2026-754
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions 7.0.6 and 8.0.0.
- Record
PYSEC-2026-754- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2018:0602
Red Hat Security Advisory: openstack-tripleo-common and openstack-tripleo-heat-templates update
- Record
RHSA-2018:0602- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2018:1593
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2018:1593- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2018:1627
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2018:1627- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12155
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
- Record
UBUNTU-CVE-2017-12155- CVSS 3.0
- 6.3 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tripleo-heat-templatesPyPI |
before 7.0.6 | 7.0.6 |
tripleo-heat-templatesPyPI |
before 7.0.6, plus listed versions 0.5.60.6.00.6.10.6.20.6.3 Show 45 moreShow less0.6.40.7.00.7.10.7.20.7.30.7.40.7.50.7.60.7.70.7.80.7.90.8.00.8.10.8.100.8.110.8.120.8.130.8.140.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.92.0.02.1.02.2.05.0.05.0.0.0b15.0.0.0b25.0.0.0b35.0.0.0rc15.0.0.0rc25.0.0.0rc35.1.05.2.05.3.05.3.15.3.105.3.115.3.125.3.135.3.2 |
7.0.6 |
openstack-tripleo-heat-templatesRed Hat:openstack:12::el7 |
before 0:7.0.9-8.el7ost | 0:7.0.9-8.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack:10::el7 |
before 0:5.3.10-1.el7ost | 0:5.3.10-1.el7ost |
puppet-tripleoRed Hat:openstack:10::el7 |
before 0:5.6.8-6.el7ost | 0:5.6.8-6.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack:11::el7 |
before 0:6.2.12-2.el7ost | 0:6.2.12-2.el7ost |
puppet-tripleoRed Hat:openstack:11::el7 |
before 0:6.5.10-3.el7ost | 0:6.5.10-3.el7ost |
tripleo-heat-templatesUbuntu:16.04:LTS |
All versions, plus listed versions 0.6.1-1 |
None known |
tripleo-heat-templatesUbuntu:18.04:LTS |
All versions, plus listed versions 5.2.0-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12155 is a medium vulnerability (CVSS 6.3) in [unknown] Openstack-tripleo-heat-templates, published December 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in tripleo-heat-templates 7.0.6.
References
access.redhat.com/errata/RHSA-2018:1593
bugzilla.redhat.com/show_bug.cgi?id=1489360
bugs.launchpad.net/tripleo/+bug/1720787
nvd.nist.gov/vuln/detail/CVE-2017-12155
Show 76 moreShow less
opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4
github.com/advisories/GHSA-w8gx-hhcx-px6w
pypi.org/project/tripleo-heat-templates
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0602.json
cve.org/CVERecord?id=CVE-2017-12155
ubuntu.com/security/CVE-2017-12155
Left out here: 41 versions. The JSON record has them.