Vulnerability Details : CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
Vulnerability category: Information leak
Products affected by CVE-2017-15139
- cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
- cpe:2.3:o:openstack:cinder:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-15139
0.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 59 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-15139
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
5.1
|
MEDIUM | CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
1.4
|
3.6
|
Red Hat, Inc. | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-15139
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2017-15139
-
https://access.redhat.com/errata/RHSA-2018:3601
RHSA-2018:3601 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://wiki.openstack.org/wiki/OSSN/OSSN-0084
OSSN/OSSN-0084 - OpenStackMitigation;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2019:0917
RHSA-2019:0917 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139
1599899 – (CVE-2017-15139) CVE-2017-15139 openstack-cinder: Data retained after deletion of a ScaleIO volumeIssue Tracking;Patch;Third Party Advisory
Jump to