Improper Authorization in barbican - CVE-2022-23451

Vulnerability identifier: #VU62575

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-23451

CWE-ID: CWE-285

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform unauthorized actions within the application.

The vulnerability exists due to improper authorization checks. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

barbican
Red Hat OpenStack
Ubuntu
python-barbican (Ubuntu package)
openstack-barbican (Red Hat package)
python3-barbican (Ubuntu package)

Install updates from vendor's website.

barbican - update to 14.0.0
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.3
python-barbican (Ubuntu package) - update to 1:6.0.1-0ubuntu1.1
openstack-barbican (Red Hat package) - addressed in versions 9.0.1-1.20220916133702.07be198.el8ost, 9.0.2-2.20220122185348.c718783.el8ost
python3-barbican (Ubuntu package) - addressed in versions 1:10.1.0-0ubuntu2.1, 2:13.0.0-0ubuntu1.2

• https://storyboard.openstack.org/#!/story/2009253
• https://bugzilla.redhat.com/show_bug.cgi?id=2025089

• Multiple vulnerabilities in Openstack barbican
• Ubuntu update for barbican
• Red Hat OpenStack Platform update for Barbican
• Red Hat OpenStack Platform 16.1 update for openstack-barbican