CVSS 3.0
6.3 mediumCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NCVE-2017-12155
Medium (6.3) in ceph ceph. EPSS 0.3% chance of exploitation in the next 30 days. Fixed in tripleo-heat-templates 7.0.6.
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 21% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ceph:ceph
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w8gx-hhcx-px6w | PyPI | tripleo-heat-templates | <7.0.6 | 7.0.6 |
| PYSEC-2026-754 | PyPI | tripleo-heat-templates | <7.0.6 | 7.0.6 |