CVE-2023-1633 Insecure barbican configuration file leaking credential

Medium 6.6 Published 24 Sep 2023 Updated 24 Sep 2024

A local authenticated attacker can read the configuration file to steal sensitive credentials in OpenStack Barbican.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-1633?

CVE-2023-1633 is a medium-severity vulnerability in OpenStack RDO, published on 24 Sep 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.

Weakness: CWE-522, CWE-200

Which versions are affected by CVE-2023-1633?

3 open source packages ship an affected version, including barbican. It affects 2 products.

Package	Affected	Fixed in
`barbican` PyPI	All versions to `16.0.0`	None
`barbican` PyPI	All versions to `16.0.0`	None
`barbican` PyPI	All versions to `16.0.0`	None

Linux distribution packages (1)

openstack-barbican Red Hat:openstack:16.2::el8 All versions 0:9.0.2-2.20230515185056.1cd585c.el8ost

Products include Openstack Barbican, Redhat Openstack Platform.

How do I fix CVE-2023-1633?

Apply the vendor's patch.

Is CVE-2023-1633 being exploited?

There is no known exploitation of CVE-2023-1633 in the wild and no public exploit code.

Sources

Also known as GHSA-6qqp-4vm3-359v, PYSEC-2026-1213, RHSA-2023:6231.