Headline
Ubuntu Security Notice USN-5697-1
Ubuntu Security Notice 5697-1 - Douglas Mendizabal discovered that Barbican incorrectly handled certain query strings. A remote attacker could possibly use this issue to bypass the access policy.
==========================================================================
Ubuntu Security Notice USN-5697-1
October 25, 2022
barbican vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
Barbican could be made to expose sensitive information over the
network.
Software Description:
- barbican: OpenStack Key Management Service - API Server
Details:
Douglas Mendizabal discovered that Barbican incorrectly handled certain
query strings. A remote attacker could possibly use this issue to bypass
the access policy.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS:
python3-barbican 2:14.0.0-0ubuntu1.1
Ubuntu 20.04 LTS:
python3-barbican 1:10.1.0-0ubuntu2.2
Ubuntu 18.04 LTS:
python-barbican 1:6.0.1-0ubuntu1.2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-5697-1
CVE-2022-3100
Package Information:
https://launchpad.net/ubuntu/+source/barbican/2:14.0.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/barbican/1:10.1.0-0ubuntu2.2
https://launchpad.net/ubuntu/+source/barbican/1:6.0.1-0ubuntu1.2
Related news
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
Red Hat Security Advisory 2022-6750-01 - Barbican is a ReST API designed for the secure storage, provisioning and management of secrets, including in OpenStack environments. Issues addressed include a bypass vulnerability.
An update for openstack-barbican is now available for Red Hat OpenStack Platform. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3100: openstack-barbican: access policy bypass via query string injection