CVE catalog

CVE-2015-3156

openstack-trove: CVE-2015-3156

Severity: Medium · CVSS 5.5CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published: Jan 1, 2015, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 25, 2026

The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	openstack-trove	sid	`1:26.0.0-2`	vulnerable
Debian	openstack-trove	forky	`1:26.0.0-2`	vulnerable
Debian	openstack-trove	trixie	`1:23.0.0-2`	vulnerable
Debian	openstack-trove	bookworm	`1:18.0.0-2`	vulnerable
Suse	openstack-trove	openstack cloud 5	`2014.2.4.juno-15.1`	fixed
Suse	openstack-trove-doc	openstack cloud 5	`2014.2.4.juno-15.1`	fixed
Ubuntu	openstack-trove	16.04	`1:4.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.1.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.1.1-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	16.04	`1:5.1.1-0ubuntu2`	vulnerable
Ubuntu	openstack-trove	18.04	`1:8.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	18.04	`1:9.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	18.04	`1:9.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	18.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:12.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:13.0.0~b1~git2019121815.5472d8a5-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:13.0.0~b2~git2020021315.2d301d0a-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:13.0.0~b3~git2020032626.3cdcfac3-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:13.0.0~b3~git2020041014.8c3df10a-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	20.04	`1:13.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	openstack-trove	22.04	`2:16.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	22.04	`2:16.0.0-0ubuntu2`	vulnerable
Ubuntu	openstack-trove	22.04	`2:16.0.0+git2021120910.be86b791-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	22.04	`2:16.0.0+git2022030314.39322f5a-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	22.04	`2:17.0.0-0ubuntu1`	vulnerable
Ubuntu	openstack-trove	22.04	`2:17.0.0-0ubuntu1.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	openstack-trove	source	sid	`(unfixed)`	unimportant	Not reported	[787654]
Debian	openstack-trove	source	forky	`(unfixed)`	unimportant	Not reported	[787654]
Debian	openstack-trove	source	trixie	`(unfixed)`	unimportant	Not reported	[787654]
Debian	openstack-trove	source	bookworm	`(unfixed)`	unimportant	Not reported	[787654]
Suse	openstack-trove	rpm	openstack cloud 5	`2014.2.4.juno-15.1`	Not reported	SUSE-SU-2016:0739-1	Not reported
Suse	openstack-trove-doc	rpm	openstack cloud 5	`2014.2.4.juno-15.1`	Not reported	SUSE-SU-2016:0739-1	Not reported

[Debian bug #787654]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[python3-trove]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-api]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-common]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-conductor]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-doc]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-guestagent]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
[trove-taskmanager]Affected
Source package: [openstack-trove]
Details (2)
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12
- 1:18.0.0-2 · all · bookworm
  Affected
  dsa · openstack-trove · debian · bookworm; dsa · openstack-trove · debian · 12

[Debian 13 (Trixie)]

[python3-trove]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-api]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-common]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-conductor]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-doc]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-guestagent]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
[trove-taskmanager]Affected
Source package: [openstack-trove]
Details (2)
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13
- 1:23.0.0-2 · all · trixie
  Affected
  dsa · openstack-trove · debian · 13

Observed: Oct 23, 2026, 5:14:51 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]