CVE-2017-15139

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-27 · updated 2026-06-17
Weakness: CWE-200

Description

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Affected products

OpenStack Cinder: through 12.0.4-7
OpenStack: 10, 13

References

https://access.redhat.com/errata/RHSA-2018:3601
https://access.redhat.com/errata/RHSA-2019:0917
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139
https://wiki.openstack.org/wiki/OSSN/OSSN-0084
https://access.redhat.com/errata/RHSA-2018:3601
https://access.redhat.com/errata/RHSA-2019:0917
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139
https://wiki.openstack.org/wiki/OSSN/OSSN-0084

Get alerted when CVE-2017-15139 or the next vulnerability affects your stack