Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

CVE-2022-23451

Published: 28 January 2022

An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Priority

Medium

Cvss 3 Severity Score

8.1

Score breakdown

Status

Package Release Status
barbican
Launchpad, Ubuntu, Debian
bionic
Released (1:6.0.1-0ubuntu1.1)
focal
Released (1:10.1.0-0ubuntu2.1)
impish
Released (2:13.0.0-0ubuntu1.2)
jammy Not vulnerable
(2:14.0.0-0ubuntu1)
kinetic Not vulnerable
(2:14.0.0-0ubuntu1)
lunar Not vulnerable
(2:14.0.0-0ubuntu1)
mantic Not vulnerable
(2:14.0.0-0ubuntu1)
noble Not vulnerable
(2:14.0.0-0ubuntu1)
trusty Ignored
(end of standard support)
upstream
Released (14.0.0)
xenial Needed

Patches:
upstream: https://opendev.org/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022
upstream: https://opendev.org/openstack/barbican/commit/af262dc30c4ec7a8c6df86b67ed202f602296d46
upstream: https://opendev.org/openstack/barbican/commit/750a79b4f5fbb94b1a1d0f329a0c8a51566b2cae
upstream: https://opendev.org/openstack/barbican/commit/b1e5386fbd714a13bb104c56b4927cf11ccddf9b
upstream: https://opendev.org/openstack/barbican/commit/64a4242454a65df17abc10e13861463a2de71813
upstream: https://opendev.org/openstack/barbican/commit/b30cb63d3a258ff26e3b9cdc0dab1e604fc6b6d1
upstream: https://opendev.org/openstack/barbican/commit/86d7d6411075a15cdea742acfa9f6d0ca42c044c
upstream: https://opendev.org/openstack/barbican/commit/32702400655675d30ebe53b2151da77532d56bb1
upstream: https://opendev.org/openstack/barbican/commit/3acf50a823bd61090d2c102a0cfa509651a8956a

Severity score breakdown

Parameter Value
Base score 8.1
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H