CVE-2017-15139

Name	CVE-2017-15139
Description	A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data. It specifically affects ScaleIO volumes using thin volumes and zero padding. This could lead to leakage of sensitive information between tenants.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
cinder (PTS)	bullseye	2:17.0.1-1+deb11u1	fixed
	bullseye (security)	2:17.4.0-1~deb11u2	fixed
	bookworm, bookworm (security)	2:21.3.1-1~deb12u1	fixed
	trixie	2:26.0.0-2	fixed
	forky, sid	2:27.0.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
cinder	source	experimental	2:13.0.0-1
cinder	source	jessie	(not affected)
cinder	source	(unstable)	2:13.0.0-2

Notes

[stretch] - cinder <no-dsa> (Minor issue)
[jessie] - cinder <not-affected> (ScaleIO Driver support does not exist)
https://wiki.openstack.org/wiki/OSSN/OSSN-0084
https://bugs.launchpad.net/ossn/+bug/1699573