CVE Feed

    Dashboard / CVE / CVE-2017-12155

    CVE-2017-12155

    A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.

    Published:Sep 19, 2017
    Last Modified:Apr 20, 2025
    EPS:Dec 12, 2017
    EPSS Score:0.00047
    CVSS Score:6.3

    Affected Products

    Vendor
    Ceph
    Product
    Ceph
    Vendor
    Redhat
    Product
    Openstack

    Exploits

    No exploit reference

    Related CVEs

    CVE-2025-30156 (CVSS 8.9) — Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions pri…
    CVE-2026-50152 (CVSS 9.1) — Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions pri…
    CVE-2026-54330 (CVSS 8.1) — Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions pri…
    CVE-2026-39944 (CVSS 8.8) — Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions pri…
    CVE-2025-52555 (CVSS 6.5) — Ceph is a distributed object, block, and file storage platform. In versions 17.2.7, 18.2.1 through 18.2.4, and…
    CVE-2020-1700 (CVSS 6.5) — A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated atta…
    CVE-2019-10222 (CVSS 7.5) — A flaw was found in the Ceph RGW configuration with Beast as the front end handling client requests. An unauth…
    CVE-2018-1129 (CVSS 6.5) — A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker ha…
    CVE-2018-10861 (CVSS 8.1) — A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to …
    CVE-2017-7519 (CVSS 2.3) — In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High