openstack-barbican Denial of Service vulnerability

MEDIUM 4.9CVE-2022-23452 · GHSA-6p2h-rjj7-2j63 · PYSEC-2026-785 · Published 01/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
barbican PyPI	`< 14.0.0`	`14.0.0`
barbican openstack	`< 14.0.0`	`14.0.0`
openstack platform redhat	`= 16.1`	No fix yet

Description

An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-23452 · ADVISORY
openstack/barbican commit 6c841b2 · WEB
access.redhat.com/errata/RHSA-2022:5114 · WEB
access.redhat.com/errata/RHSA-2022:8874 · WEB
access.redhat.com/security/cve/CVE-2022-23452 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
review.opendev.org/c/openstack/barbican/+/814200 · WEB
storyboard.openstack.org · WEB
storyboard.openstack.org · WEB
pypi.org/project/barbican · PACKAGE
GitHub Advisory GHSA-6p2h-rjj7-2j63 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free