CVE-2017-15139
CVE-2017-15139
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
CVSS 5.1 · Medium · EPSS 1.2% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
openstack-cinder
- Versions
- up to and including Queens: Affected
No fix published
cinder Debian:12
- Affected ranges
- ECOSYSTEM: < 2:13.0.0-2
Update to 2:13.0.0-2
cinder Debian:13
- Affected ranges
- ECOSYSTEM: < 2:13.0.0-2
Update to 2:13.0.0-2
cinder Debian:14
- Affected ranges
- ECOSYSTEM: < 2:13.0.0-2
Update to 2:13.0.0-2
cinder Ubuntu:16.04:LTS
- Versions
- 2:7.0.0-0ubuntu1
- 2:8.0.0~b1-0ubuntu1
- 2:8.0.0~b2-0ubuntu2
- 2:8.0.0~b3-0ubuntu2
- 2:8.0.0~rc1-0ubuntu2
- 2:8.0.0-0ubuntu1
- 2:8.1.0-0ubuntu1
- 2:8.1.1-0ubuntu1
- 2:8.1.1-0ubuntu3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cinder Ubuntu:18.04:LTS
- Versions
- 2:11.0.0-0ubuntu2
- 2:11.0.0-0ubuntu3
- 2:12.0.0~b1-0ubuntu1
- 2:12.0.0~b2-0ubuntu2
- 2:12.0.0~rc1-0ubuntu1
- 2:12.0.0~rc2-0ubuntu1
- 2:12.0.0~rc2-0ubuntu2
- 2:12.0.0-0ubuntu1
- 2:12.0.1-0ubuntu1
- 2:12.0.3-0ubuntu1
- 2:12.0.4-0ubuntu1
- 2:12.0.5-0ubuntu1
- 2:12.0.7-0ubuntu2
- 2:12.0.9-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 2:12.0.9-0ubuntu1.2
Update to 2:12.0.9-0ubuntu1.2