Headline

RHSA-2022:8874: Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update

An update for openstack-barbican is now available for Red Hat OpenStack Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-23451: openstack-barbican: Barbican allows authenticated users to add/modify/delete arbitrary metadata on any secret
CVE-2022-23452: openstack-barbican: Barbican allows anyone with an admin role to add their secrets to a different project’s containers

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #auth #ibm

Skip to navigation Skip to main content

Utilities

Subscriptions
Downloads
Containers
Support Cases

Infrastructure and Management

Red Hat Enterprise Linux
Red Hat Virtualization
Red Hat Identity Management
Red Hat Directory Server
Red Hat Certificate System
Red Hat Satellite
Red Hat Subscription Management
Red Hat Update Infrastructure
Red Hat Insights
Red Hat Ansible Automation Platform

Cloud Computing

Red Hat OpenShift
Red Hat CloudForms
Red Hat OpenStack Platform
Red Hat OpenShift Container Platform
Red Hat OpenShift Data Science
Red Hat OpenShift Online
Red Hat OpenShift Dedicated
Red Hat Advanced Cluster Security for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Quay
OpenShift Dev Spaces
Red Hat OpenShift Service on AWS

Storage

Red Hat Gluster Storage
Red Hat Hyperconverged Infrastructure
Red Hat Ceph Storage
Red Hat OpenShift Data Foundation

Runtimes

Red Hat Runtimes
Red Hat JBoss Enterprise Application Platform
Red Hat Data Grid
Red Hat JBoss Web Server
Red Hat Single Sign On
Red Hat support for Spring Boot
Red Hat build of Node.js
Red Hat build of Thorntail
Red Hat build of Eclipse Vert.x
Red Hat build of OpenJDK
Red Hat build of Quarkus

Integration and Automation

Red Hat Process Automation
Red Hat Process Automation Manager
Red Hat Decision Manager

All Products

Issued:

2022-12-07

Updated:

2022-12-07

RHSA-2022:8874 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for openstack-barbican is now available for Red Hat OpenStack
Platform 16.1.9 (Train) for Red Hat Enterprise Linux (RHEL) 8.2.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Barbican is a REST API designed for the secure storage, provisioning and
management of secrets, including in OpenStack environments.

Security Fix(es):

Barbican allows authenticated users to add/modify/delete arbitrary

metadata on any secret (CVE-2022-23451)

Barbican allows anyone with an admin role to add their secrets to a

different project’s containers (CVE-2022-23452)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.

Affected Products

Red Hat OpenStack for IBM Power 16.1 ppc64le
Red Hat OpenStack 16.1 x86_64

Fixes

BZ - 1965086 - barbican with atos HSM operations alternately succeed and fail
BZ - 2025089 - CVE-2022-23451 openstack-barbican: Barbican allows authenticated users to add/modify/delete arbitrary metadata on any secret
BZ - 2025090 - CVE-2022-23452 openstack-barbican: Barbican allows anyone with an admin role to add their secrets to a different project’s containers
BZ - 2025979 - Barbican unable to set up secrets
BZ - 2026029 - Support of project owned keys

Red Hat OpenStack for IBM Power 16.1

SRPM

openstack-barbican-9.0.1-1.20220916133702.07be198.el8ost.src.rpm

SHA-256: e83bb0d821f90e72d7f549dfdc22b2090b475c2b977cc7e263ead891a42a8e55

ppc64le

openstack-barbican-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: 6df08e6195a7e38f88091d05bb01fa239e4596a616fceaa049b300f788ea8dd9

openstack-barbican-api-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: ce817edb2056622f24d72fa3e763902b2c38a38c5b34d91d58c8ddb195f2785a

openstack-barbican-common-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: 9c0250133185923a3bda4c23720c0e0727b0e2376892a772e9e39b79ae0e24f9

openstack-barbican-keystone-listener-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: ac53520c9ee0b401a4c0fb57dcf5dbec512e4c0e23f24e523a796021a0cf3880

openstack-barbican-worker-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: 1581bacce8b28350fa200fe1114da723e467238f99f40c62bc16fc1a8351d658

python3-barbican-9.0.1-1.20220916133702.07be198.el8ost.noarch.rpm

SHA-256: 091a949cfca9dd2039461b8704666318f2bbd0de10a1104f603519abb82d4315

Red Hat OpenStack 16.1

SRPM

openstack-barbican-9.0.1-1.20220916133702.07be198.el8ost.src.rpm

SHA-256: e83bb0d821f90e72d7f549dfdc22b2090b475c2b977cc7e263ead891a42a8e55

x86_64