PT-2022-15997 · Openstack+3 · Openstack-Barbican+3

Pedro Sampaio · Published 2022-01-28 · Updated 2023-02-13 · CVE-2022-23451

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions openstack-barbican (affected versions not specified)

Description An authorization flaw was found in the default policy rules for the secret metadata API, allowing any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This issue enables an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-23451

GHSA-P2JG-Q8HW-P7GC

RHSA-2022:5114

RHSA-2022:8874

SUSE-SU-2022:1729-1

USN-5387-1

Affected Products

Debian

Linuxmint

Ubuntu

Openstack-Barbican

References · 58

• https://review.opendev.org/c/openstack/barbican/+/811236 · Patch
• https://ubuntu.com/security/notices/USN-5387-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23451 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23451 · Security Note
• https://osv.dev/vulnerability/USN-5387-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2jg-q8hw-p7gc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23451 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23451 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23451 · Security Note
• https://ubuntu.com/security/CVE-2022-23452 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1729-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23451 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23451 · Vendor Advisory
• https://github.com/openstack/barbican · Note
• https://github.com/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022 · Note