Description
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenStack Foundation | openstack-cinder | up to and including Queens | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cinder | 2:13.0.0-2 | — |
| Debian 13 | cinder | 2:13.0.0-2 | — |
| Debian 12 | cinder | 2:13.0.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | cinder | 2:12.0.9-0ubuntu1.2 | — |
| Ubuntu 16.04 LTS | cinder | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 13 | python-cinder +1 | 1:12.0.4-2.el7ost | RHSA-2018:3601 |
| Red Hat OpenStack 10 | python-cinder +2 | 1:9.1.4-50.el7ost | RHSA-2019:0917 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 7 | openstack-cinder +1 | 9.1.5~dev6-4.21.3 | SUSE-SU-2019:0716-1 |
| SUSE OpenStack Cloud 7 | openstack-horizon-plugin-designate-ui | 3.0.2~dev1-3.9.3 | SUSE-SU-2019:0716-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron +1 | 9.4.2~dev21-7.27.3 | SUSE-SU-2019:0716-1 |
| SUSE OpenStack Cloud 7 | openstack-neutron-lbaas +1 | 9.2.2~dev11-4.15.3 | SUSE-SU-2019:0716-1 |
Advisories 3
- RHSA-2019:0917 Red Hat Security Advisory: openstack-cinder security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:3601 Red Hat Security Advisory: openstack-cinder security and bug fix update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- SUSE-SU-2019:0716-1 Security update for openstack-cinder, openstack-horizon-plugin-designate-ui, openstack-neutron, openstack-neutron-lbaas SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://wiki.openstack.org/wiki/OSSN/OSSN-0084
- RHSA-2018:3601 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15139
- RHSA-2019:0917 vendor-advisory