CVE catalog

CVE-2017-15139

cinder: CVE-2017-15139

Severity: Medium · CVSS 5.1CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published: Jan 1, 2017, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.24% · Oct 25, 2026

A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	cinder	sid	`2:29.0.0-3`	fixed
Debian	cinder	forky	`2:28.0.0-1`	fixed
Debian	cinder	trixie	`2:26.0.0-2`	fixed
Debian	cinder	bookworm	`2:21.3.1-1~deb12u1`	fixed
Debian	cinder	bookworm-security	`2:21.3.1-1~deb12u1`	fixed
Suse	openstack-cinder	openstack cloud 7	`9.1.5~dev6-4.21.3`	fixed
Suse	openstack-cinder-doc	openstack cloud 7	`9.1.5~dev6-4.21.3`	fixed
Suse	openstack-horizon-plugin-designate-ui	openstack cloud 7	`3.0.2~dev1-3.9.3`	fixed
Suse	openstack-neutron	openstack cloud 7	`9.4.2~dev21-7.27.3`	fixed
Suse	openstack-neutron-doc	openstack cloud 7	`9.4.2~dev21-7.27.3`	fixed
Suse	openstack-neutron-lbaas	openstack cloud 7	`9.2.2~dev11-4.15.3`	fixed
Suse	openstack-neutron-lbaas-doc	openstack cloud 7	`9.2.2~dev11-4.15.3`	fixed
Ubuntu	cinder	16.04	`2:7.0.0-0ubuntu1`	vulnerable
Ubuntu	cinder	16.04	`2:8.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	cinder	16.04	`2:8.0.0~b2-0ubuntu2`	vulnerable
Ubuntu	cinder	16.04	`2:8.0.0~b3-0ubuntu2`	vulnerable
Ubuntu	cinder	16.04	`2:8.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	cinder	16.04	`2:8.0.0-0ubuntu1`	vulnerable
Ubuntu	cinder	16.04	`2:8.1.0-0ubuntu1`	vulnerable
Ubuntu	cinder	16.04	`2:8.1.1-0ubuntu1`	vulnerable
Ubuntu	cinder	16.04	`2:8.1.1-0ubuntu3`	vulnerable
Ubuntu	cinder	18.04	`2:11.0.0-0ubuntu2`	vulnerable
Ubuntu	cinder	18.04	`2:11.0.0-0ubuntu3`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0~b2-0ubuntu2`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0~rc2-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0~rc2-0ubuntu2`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.0-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.1-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.3-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.4-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.5-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.7-0ubuntu2`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.9-0ubuntu1`	vulnerable
Ubuntu	cinder	18.04	`2:12.0.9-0ubuntu1.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	cinder	source	sid	`2:13.0.0-2`	not yet assigned	Not reported	Not reported
Debian	cinder	source	forky	`2:13.0.0-2`	not yet assigned	Not reported	Not reported
Debian	cinder	source	trixie	`2:13.0.0-2`	not yet assigned	Not reported	Not reported
Debian	cinder	source	bookworm	`2:13.0.0-2`	not yet assigned	Not reported	Not reported
Suse	openstack-cinder	rpm	openstack cloud 7	`9.1.5~dev6-4.21.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-cinder-doc	rpm	openstack cloud 7	`9.1.5~dev6-4.21.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-horizon-plugin-designate-ui	rpm	openstack cloud 7	`3.0.2~dev1-3.9.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-neutron	rpm	openstack cloud 7	`9.4.2~dev21-7.27.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-neutron-doc	rpm	openstack cloud 7	`9.4.2~dev21-7.27.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-neutron-lbaas	rpm	openstack cloud 7	`9.2.2~dev11-4.15.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Suse	openstack-neutron-lbaas-doc	rpm	openstack cloud 7	`9.2.2~dev11-4.15.3`	Not reported	SUSE-SU-2019:0716-1	Not reported
Ubuntu	cinder	deb	18.04	`2:12.0.9-0ubuntu1.2`	Not reported	UBUNTU-CVE-2017-15139	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[cinder-api]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[cinder-backup]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[cinder-common]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[cinder-doc]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[cinder-scheduler]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[cinder-volume]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
[python3-cinder]Fixed
Source package: [cinder]
Details (4)
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12
- 2:21.3.1-1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · bookworm; dsa · cinder · debian · 12

[Debian 13 (Trixie)]

[cinder-api]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[cinder-backup]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[cinder-common]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[cinder-doc]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[cinder-scheduler]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[cinder-volume]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
[python3-cinder]Fixed
Source package: [cinder]
Details (2)
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13
- 2:26.0.0-2 · all · trixie
  Fixed · Fixed: 2:13.0.0-2
  dsa · cinder · debian · 13

Observed: Oct 23, 2026, 5:27:08 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]