CVE-2017-12155 - CVE House
Back to Database
Status published Medium CVE-2017-12155

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where...

Vulnerability Description

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-12155

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenStack

View All →
CVE-2025-65073
OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens...
High 7.5
CVE-2025-44021
OpenStack Ironic before 29.0.1 can write unintended files to a...
Low 2.8
CVE-2022-38065
A privilege escalation vulnerability exists in the oslo.privsep functionality of...
High 8.8
CVE-2022-38060
A privilege escalation vulnerability exists in the sudo functionality of...
High 8.8
CVE-2013-2255
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly...
Medium 5.9

Affected Vendor

Affected Software

openstack-tripleo-heat-templates
Vulnerable Versions:
Newton, Ocata, Pike and possibly older

Timeline

Official Publish: December 12th, 2017
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.