Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-15139: OpenStack Cinder may expose old data in new volumes

CVE-2017-15139 · published 8 years ago

Summary

Versions of OpenStack Cinder up to the Queens release can accidentally copy leftover data into newly created storage volumes when using ScaleIO thin volumes with zero padding. This can let one tenant see data that belongs to another tenant, risking confidential information. Upgrade to a patched version or change the storage configuration to eliminate the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
openstack	cinder	<= 12.0.4-7 `cpe:2.3:o:openstack:cinder::::::::`
redhat	openstack	10 13 `cpe:2.3:a:redhat:openstack:10:::::::*`

Original advisory text

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

References

https://access.redhat.com/errata/RHSA-2018:3601 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0917 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139 Issue Tracking Patch Third Party Advisory
https://wiki.openstack.org/wiki/OSSN/OSSN-0084 Mitigation Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published27 Aug 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-15139 · NVD

Track software like this

Free during beta