CVE-2017-15139

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
OpenStack Foundation	openstack-cinder	up to and including Queens

References

https://access.redhat.com/errata/RHSA-2018:3601Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0917Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139Issue Tracking, Patch, Third Party Advisory
https://wiki.openstack.org/wiki/OSSN/OSSN-0084Mitigation, Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3601Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0917Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139Issue Tracking, Patch, Third Party Advisory
https://wiki.openstack.org/wiki/OSSN/OSSN-0084Mitigation, Third Party Advisory

Timeline

Published: Aug 27, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-15154.3IBM Doors Web Access 9.5 and 9.6 could allow an authenticated user to obtain sensitive information from HTTP internal server error responses CVE-2017-15165.4IBM Doors Web Access 9.5 and 9.6 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit CVE-2017-151855.0plugins/ogg.c in Libmp3splt 0.9.2 calls the libvorbis vorbis_block_clear function with uninitialized data upon detection of invalid input, w CVE-2017-151866.5Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote attackers to cause a denial of service via a crafted AVI file.CVE-2017-151884.8A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to CVE-2017-151897.5In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an infinite loop. This was addressed in plugins/docsis/packet-docsis.c by ad CVE-2017-15195.9IBM DB2 10.5 and 11.1 contains a denial of service vulnerability. A remote user can cause disruption of service for DB2 Connect Server setup CVE-2017-151907.5In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was addressed in epan/dissectors/packet-rtsp.c by correcting the scope of CVE-2017-151917.5In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the DMP dissector could crash. This was addressed in epan/dissectors/packe CVE-2017-151927.5In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector could crash. This was addressed in epan/dissectors/packet-btatt.c by co CVE-2017-151937.5In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector could crash or exhaust system memory. This was addressed in epan/dissecto CVE-2017-151946.1include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.