PT-2018-5782 · Openstack · Openstack Cinder

Nick Tait · Publicado 2018-08-27 · Atualizado 2023-02-03 · CVE-2017-15139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: openstack-cinder versions up to and including Queens

Description: A vulnerability was found in openstack-cinder, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Recommendations: For openstack-cinder versions up to and including Queens, consider reconfiguring storage volume settings to avoid using thin volumes and zero padding with ScaleIO volumes until a fix is available. As a temporary workaround, restrict access to sensitive information stored on newly created volumes to minimize the risk of data leakage.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-15139

RHSA-2018:3601

RHSA-2019:0917

SUSE-SU-2019:0716-1

Produtos afetados

Openstack Cinder

Referências · 20

• https://bugzilla.suse.com/1116475 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15139 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-15139 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-15139 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15139 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-15139 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-15139 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:3601 · Aviso do Fabricante
• https://bugzilla.suse.com/1089834 · Nota
• https://bugzilla.suse.com/1119902 · Nota
• https://bugzilla.suse.com/1124695 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20190716-1 · Nota
• https://osv.dev/vulnerability/CVE-2017-15139 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:0716-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:0917 · Aviso do Fabricante