Every CVE Search/ Get API key

CVE-2017-15139

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly...

5.1 MediumFix available

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.24%Up 0.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.1

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
CVE-2017-15139
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2017-6599 5.1

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
EUVD-2017-6599
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-j9j4-4235-xf59 7.5

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly...

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
GHSA-j9j4-4235-xf59
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 7.5

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
CVE-2017-15139
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 7.5

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
CVE-2017-15139
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-15139 7.5

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
DEBIAN-CVE-2017-15139
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2018:3601 4.8

Red Hat Security Advisory: openstack-cinder security and bug fix update

Record
RHSA-2018:3601
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2019:0917 4.8

Red Hat Security Advisory: openstack-cinder security and bug fix update

Record
RHSA-2019:0917
CVSS 3.0
4.8 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2017-15139 7.5

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Record
UBUNTU-CVE-2017-15139
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVSUSE-SU-2019:0716-1 No score

Security update for openstack-cinder, openstack-horizon-plugin-designate-ui, openstack-neutron, openstack-neutron-lbaas

This update for openstack-cinder, openstack-horizon-plugin-designate-ui, openstack-neutron, openstack-neutron-lbaas fixes the following issues:

Security vulnerabity fixed in openstack-cinder:

  • CVE-2017-15139: Fixed a leakage of sensitive information between tenants in certain storage volume configurations (bsc#1105476)

Bug fixes and other changes in openstack-horizon-plugin-designate-ui:

  • Remove the py{c} files unconditionally without error messages

Bug fixes and other changes in openstack-neutron:

  • Fixed an issue with neutron leaving behind ovs ports when already in skipped_ports (bsc#1124695)
  • Require version and release to ensure that subpackages are consistent and coherent (bsc#1119902)
  • Fixed an issue with lbass neutron ports being down or in status build (bsc#1119902)
  • Enable liberal TCP connection tracking to prevent connection resets (bsc#1116475)
  • Switch to mariadb.service
  • Add dependency on rabbitmq to neutron-server.service

Bug fixes and changes in openstack-neutron-lbaas.changes

  • Improve performance of loadbalancer objects (bsc#1089834)
Record
SUSE-SU-2019:0716-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cinder
Debian:12
 before 2:13.0.0-2
2:13.0.0-2
cinder
Debian:13
 before 2:13.0.0-2
2:13.0.0-2
cinder
Debian:14
 before 2:13.0.0-2
2:13.0.0-2
openstack-cinder
Red Hat:openstack:13::el7
 before 1:12.0.4-2.el7ost
1:12.0.4-2.el7ost
python-cinder
Red Hat:openstack:13::el7
 before 1:12.0.4-2.el7ost
1:12.0.4-2.el7ost
openstack-cinder
Red Hat:openstack:10::el7
 before 1:9.1.4-50.el7ost
1:9.1.4-50.el7ost
python-cinder
Red Hat:openstack:10::el7
 before 1:9.1.4-50.el7ost
1:9.1.4-50.el7ost
python-cinder-tests
Red Hat:openstack:10::el7
 before 1:9.1.4-50.el7ost
1:9.1.4-50.el7ost
openstack-cinder
SUSE:OpenStack Cloud 7
 before 9.1.5~dev6-4.21.3
9.1.5~dev6-4.21.3
openstack-cinder-doc
SUSE:OpenStack Cloud 7
 before 9.1.5~dev6-4.21.3
9.1.5~dev6-4.21.3
Show 7 moreShow less
Affected packages
PackageAffectedFixed
openstack-horizon-plugin-designate-ui
SUSE:OpenStack Cloud 7
 before 3.0.2~dev1-3.9.3
3.0.2~dev1-3.9.3
openstack-neutron
SUSE:OpenStack Cloud 7
 before 9.4.2~dev21-7.27.3
9.4.2~dev21-7.27.3
openstack-neutron-doc
SUSE:OpenStack Cloud 7
 before 9.4.2~dev21-7.27.3
9.4.2~dev21-7.27.3
openstack-neutron-lbaas
SUSE:OpenStack Cloud 7
 before 9.2.2~dev11-4.15.3
9.2.2~dev11-4.15.3
openstack-neutron-lbaas-doc
SUSE:OpenStack Cloud 7
 before 9.2.2~dev11-4.15.3
9.2.2~dev11-4.15.3
cinder
Ubuntu:16.04:LTS
 All versions, plus listed versions
2:7.0.0-0ubuntu12:8.0.0~b1-0ubuntu12:8.0.0~b2-0ubuntu22:8.0.0~b3-0ubuntu22:8.0.0~rc1-0ubuntu2
Show 4 moreShow less
2:8.0.0-0ubuntu12:8.1.0-0ubuntu12:8.1.1-0ubuntu12:8.1.1-0ubuntu3
 None known
cinder
Ubuntu:18.04:LTS
 before 2:12.0.9-0ubuntu1.2, plus listed versions
2:11.0.0-0ubuntu22:11.0.0-0ubuntu32:12.0.0~b1-0ubuntu12:12.0.0~b2-0ubuntu22:12.0.0~rc1-0ubuntu1
Show 9 moreShow less
2:12.0.0~rc2-0ubuntu12:12.0.0~rc2-0ubuntu22:12.0.0-0ubuntu12:12.0.1-0ubuntu12:12.0.3-0ubuntu12:12.0.4-0ubuntu12:12.0.5-0ubuntu12:12.0.7-0ubuntu22:12.0.9-0ubuntu1
2:12.0.9-0ubuntu1.2

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-15139 is a medium vulnerability (CVSS 5.1) in Openstack Cinder, published August 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. Fixed in cinder 2:13.0.0-2.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open