CVE-2017-12155: ceph
Vulnerability summary
CVE-2017-12155 is a medium (CVSS 6.3) vulnerability in ceph. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 12-12-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · PypiEcosystem advisory · calculated6.3MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated8.4HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
-0.04 pp
From 0.32% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- ceph-18All versions (No fix recorded)
- ceph-19All versions (No fix recorded)
- ceph-20All versions (No fix recorded)
Ceph1 product
- cephna
Openstack1 product
- openstack-tripleo-heat-templatesNewton, Ocata, Pike and possibly older
PyPI1 product
- tripleo-heat-templates< 7.0.6
Redhat1 product
- openstack-tripleo-heat-templates< 0:7.0.9-8.el7ost
Ubuntu1 product
- tripleo-heat-templatesAll versions (No fix recorded)
Wolfi1 product
- ceph-20All versions (No fix recorded)
7 vendors · 9 products
