PT-2018-5782 · Openstack · Openstack Cinder

Nick Tait · Published 2018-08-27 · Updated 2023-02-03 · CVE-2017-15139

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: openstack-cinder versions up to and including Queens

Description: A vulnerability was found in openstack-cinder, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Recommendations: For openstack-cinder versions up to and including Queens, consider reconfiguring storage volume settings to avoid using thin volumes and zero padding with ScaleIO volumes until a fix is available. As a temporary workaround, restrict access to sensitive information stored on newly created volumes to minimize the risk of data leakage.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-15139

RHSA-2018:3601

RHSA-2019:0917

SUSE-SU-2019:0716-1

Affected Products

Openstack Cinder

References · 20

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15139 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15139 · Security Note
• https://ubuntu.com/security/CVE-2017-15139 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15139 · Security Note
• https://access.redhat.com/errata/RHSA-2018:3601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15139 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0716-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0917 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-15139 · Vendor Advisory
• https://bugzilla.suse.com/1116475 · Note
• https://suse.com/security/cve/CVE-2017-15139 · Note
• https://bugzilla.suse.com/1089834 · Note
• https://bugzilla.suse.com/1119902 · Note