PYSEC-2026-786
Barbican authorization flaw before v14.0.0
At a glance
- Published
- Updated
- CVE
- CVE-2022-23451
- Aliases
- GHSA-p2jg-q8hw-p7gc
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Description
An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.
Affected packages
| Package | Versions |
|---|---|
| PyPI · barbican | introduced 0, fixed 14.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-23451 ADVISORY
- https://github.com/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022 WEB
- https://access.redhat.com/errata/RHSA-2022:5114 WEB
- https://access.redhat.com/errata/RHSA-2022:8874 WEB
- https://access.redhat.com/security/cve/CVE-2022-23451 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2022878 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2025089 WEB
- https://github.com/openstack/barbican PACKAGE
- https://review.opendev.org/c/openstack/barbican/+/811236 WEB
- https://pypi.org/project/barbican PACKAGE
- https://github.com/advisories/GHSA-p2jg-q8hw-p7gc ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |