CVE-2022-23452 openstack-barbican Denial of Service vulnerability
An admin user can add secrets to other project containers, allowing resource consumption and denial of service in OpenStack Barbican.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23452?
CVE-2022-23452 is a medium-severity missing authorization vulnerability in openstack/barbican, published on 1 Sep 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.
Weakness: CWE-863
Which versions are affected by CVE-2022-23452?
3 open source packages ship an affected version, including barbican. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
barbican PyPI | All versions | 14.0.0 |
barbican PyPI | All versions | 14.0.0 |
barbican PyPI | All versions | 14.0.0 |
Products include Openstack Barbican, Redhat Openstack Platform.
How do I fix CVE-2022-23452?
Upgrade barbican to 14.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23452 being exploited?
There is no known exploitation of CVE-2022-23452 in the wild and no public exploit code.
Other vulnerabilities in openstack/barbican
Sources
Also known as DEBIAN-CVE-2022-23452, GHSA-6p2h-rjj7-2j63, PYSEC-2026-785, UBUNTU-CVE-2022-23452.