CVE-2022-3100
Fixed in a distro release EPSS <1%CVSS 5.9
A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
Products: openstack barbican, redhat openstack, redhat openstack_for_ibm_power, redhat openstack_platform
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | barbican | 1:7.0.0-1+deb10u1 |
| Debian 11 | barbican | 1:11.0.0-3+deb11u1 |
| Debian 12 | barbican | 1:15.0.0~rc3-1 |
| Debian 13 | barbican | 1:15.0.0~rc3-1 |
| Debian 14 | barbican | 1:15.0.0~rc3-1 |
| Red Hat openstack 13 | openstack-barbican | 0:6.0.1-6.el7ost |
| Red Hat openstack 13 | openstack-barbican-api | 0:6.0.1-6.el7ost |
| Red Hat openstack 13 | openstack-barbican-common | 0:6.0.1-6.el7ost |
| Red Hat openstack 16.1 | openstack-barbican | 0:9.0.1-1.20220112203416.07be198.el8ost |
| Red Hat openstack 16.1 | openstack-barbican-api | 0:9.0.1-1.20220112203416.07be198.el8ost |
| Red Hat openstack 16.1 | openstack-barbican-common | 0:9.0.1-1.20220112203416.07be198.el8ost |
| Red Hat openstack 16.1 | python3-barbican | 0:9.0.1-1.20220112203416.07be198.el8ost |
| Red Hat openstack 16.2 | openstack-barbican | 0:9.0.2-2.20220122185349.c718783.el8ost |
| Red Hat openstack 16.2 | openstack-barbican-api | 0:9.0.2-2.20220122185349.c718783.el8ost |
| Red Hat openstack 16.2 | openstack-barbican-common | 0:9.0.2-2.20220122185349.c718783.el8ost |
| Red Hat openstack 16.2 | python3-barbican | 0:9.0.2-2.20220122185349.c718783.el8ost |
| Red Hat openstack 17.0 | openstack-barbican | 0:12.0.1-0.20220614210405.486e607.el9ost |
| Red Hat openstack 17.0 | openstack-barbican-api | 0:12.0.1-0.20220614210405.486e607.el9ost |
| Red Hat openstack 17.0 | openstack-barbican-common | 0:12.0.1-0.20220614210405.486e607.el9ost |
| Red Hat openstack 17.0 | python3-barbican | 0:12.0.1-0.20220614210405.486e607.el9ost |
| SUSE HPE Helion OpenStack 8 | openstack-barbican | 5.0.2~dev3-3.17.2 |
| SUSE HPE Helion OpenStack 8 | openstack-barbican-doc | 5.0.2~dev3-3.17.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-barbican | 5.0.2~dev3-12.43.2 |
| SUSE OpenStack Cloud 8 | openstack-barbican | 5.0.2~dev3-3.17.2 |
| SUSE OpenStack Cloud 8 | openstack-barbican-doc | 5.0.2~dev3-3.17.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-barbican | 5.0.2~dev3-12.43.2 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.17.1 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev209-3.43.1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 |
| SUSE OpenStack Cloud 9 | spark | 2.2.3-5.12.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.37.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.43.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev209-6.43.1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.43.1 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-barbican | 5.0.2~dev3-3.17.2 |
| SUSE OpenStack Cloud Crowbar 8 | openstack-barbican-doc | 5.0.2~dev3-3.17.2 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.17.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev209-3.43.1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 |
| SUSE OpenStack Cloud Crowbar 9 | spark | 2.2.3-5.12.1 |
| Ubuntu 16.04 LTS | barbican | no fix |
| Ubuntu 18.04 LTS | barbican | 1:6.0.1-0ubuntu1.2 |
| Ubuntu 20.04 LTS | barbican | 1:10.1.0-0ubuntu2.2 |
| Ubuntu 22.04 LTS | barbican | 2:14.0.0-0ubuntu1.1 |