CVE-2023-1636 Incomplete container isolation
Attackers can access Barbican data if a neighboring service is compromised in all-in-one OpenStack deployments due to shared container namespaces.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1636?
CVE-2023-1636 is a medium-severity vulnerability in OpenStack RDO, published on 24 Sep 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
Weakness: CWE-653
Which versions are affected by CVE-2023-1636?
3 open source packages ship an affected version, including barbican. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
barbican PyPI | All versions to 16.0.0 | None |
barbican PyPI | All versions to 16.0.0 | None |
barbican PyPI | All versions to 16.0.0 | None |
Products include Openstack Barbican, Redhat Openstack Platform.
How do I fix CVE-2023-1636?
No fix has been published for CVE-2023-1636 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-1636 being exploited?
There is no known exploitation of CVE-2023-1636 in the wild and no public exploit code.
Other vulnerabilities in OpenStack RDO
Sources
Also known as GHSA-6rx9-c2rh-3qv4, PYSEC-2026-1214.