{"id":"CVE-2022-23451","aliases":["DEBIAN-CVE-2022-23451","EUVD-2022-6888","GHSA-p2jg-q8hw-p7gc","PYSEC-2026-786","RHSA-2022:5114","RHSA-2022:8874","SUSE-SU-2022:1729-1","UBUNTU-CVE-2022-23451","USN-5387-1"],"status":"published","title":"Barbican authorization flaw before v14.0.0","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0128,"percentile":0.70226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-01-28T00:00:00Z","modified":"2026-11-03T08:03:49Z","fixes":[{"ecosystem":"PyPI","package":"barbican","fixed_in":["14.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"barbican","fixed_in":["1:6.0.1-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"barbican","fixed_in":["1:10.1.0-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-keystone-listener","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-keystone-listener","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1644879908.8a641c1-3.13.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.35.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.38.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-4.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.36.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.41.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.37.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-6.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.0.0-0ubuntu1","1:2.0.0~b1-0ubuntu1","1:2.0.0~b2-0ubuntu1","1:2.0.0~b2-0ubuntu2","1:2.0.0~b2-0ubuntu3","1:2.0.0~b3-0ubuntu1","1:2.0.0~rc1-0ubuntu1","1:2.0.0-0ubuntu1","1:2.0.0-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2"],"bundled":2}],"products":[{"vendor":"openstack","product":"barbican"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025089","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022878","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","report","web"]},{"url":"https://storyboard.openstack.org/#%21/story/2009253","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://review.opendev.org/c/openstack/barbican/+/811236","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23451","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23451","tags":["advisory"]},{"url":"https://github.com/openstack/barbican/commit/7d270bacbe29a90a10f1855abc3b50dac0f08022","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5114","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8874","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-p2jg-q8hw-p7gc","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23451.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23451","tags":["advisory"]},{"url":"https://github.com/openstack/barbican","tags":["package"]},{"url":"https://pypi.org/project/barbican","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025090","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5114.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23451","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23452","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23452","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23452","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026029","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8874.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1179534","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1186380","tags":["report"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1192070","tags":["report"]},{"url":"https://bugzilla.suse.com/1192073","tags":["report"]},{"url":"https://bugzilla.suse.com/1192075","tags":["report"]},{"url":"https://bugzilla.suse.com/1193597","tags":["report"]},{"url":"https://bugzilla.suse.com/1193688","tags":["report"]},{"url":"https://bugzilla.suse.com/1193752","tags":["report"]},{"url":"https://bugzilla.suse.com/1194521","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://bugzilla.suse.com/1194952","tags":["report"]},{"url":"https://bugzilla.suse.com/1194954","tags":["report"]},{"url":"https://bugzilla.suse.com/1199138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29970","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23451","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5387-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23452","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-23451","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-06T17:18:52Z","modified":"2024-08-03T03:43:46.011Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-6888","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-06T17:18:52Z","modified":"2024-08-03T03:43:46Z","updated_at":"2026-11-03T03:25:51.181739Z"}],"ghsa":[{"id":"GHSA-p2jg-q8hw-p7gc","title":"Barbican authorization flaw before v14.0.0","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-07T00:01:53Z","modified":"2023-02-03T20:41:25Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:36:44.093794Z"}],"nvd":[{"id":"CVE-2022-23451","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-06T18:15:10.64Z","modified":"2026-06-17T04:30:08.933Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"DEBIAN-CVE-2022-23451","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-06T18:15:10.64Z","modified":"2026-11-03T08:03:49.85946142Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-p2jg-q8hw-p7gc","title":"Barbican authorization flaw before v14.0.0","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-07T00:01:53Z","modified":"2026-07-07T11:56:28.239146988Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"PYSEC-2026-786","title":"Barbican authorization flaw before v14.0.0","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2026-07-06T08:03:32.432094Z","modified":"2026-07-07T11:45:43.148210972Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2022:5114","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-barbican) security update","status":"published","published":"2024-09-16T08:25:26Z","modified":"2026-08-08T10:02:04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:8874","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update","status":"published","published":"2024-09-16T08:25:33Z","modified":"2026-08-08T10:02:21Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-23451","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-01-28T00:00:00Z","modified":"2026-02-04T04:01:25.914377Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-23451","description":"An authorization flaw was found in openstack-barbican. The default policy rules for the secret metadata API allowed any authenticated user to add, modify, or delete metadata from any secret regardless of ownership. This flaw allows an attacker on the network to modify or delete protected data, causing a denial of service by consuming protected resources.","status":"published","published":"2022-09-06T17:18:52Z","modified":"2026-10-28T02:31:01.835084611Z","cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"SUSE-SU-2022:1729-1","title":"Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud","description":"This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:\n\nSecurity fixes included on the update:\n\nardana-barbican:\n\n- Update policies to protect container secret access (SOC-11621)\n- Update policies to protect secret metadata access (SOC-11620)\n\nopenstack-neutron:\n\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n\nrubygem-sinatra:\n\n- CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).\n\npython-XStatic-jquery-ui:\n\n- CVE-2021-41182: Fixed XSS in the `altField` option of the Datepicker widget (bsc#1192070)\n- CVE-2021-41183: Fixed XSS in the `of` option of the `.position()` util (bsc#1192073)\n- CVE-2021-41184: Fixed XSS in `*Text` options of the Datepicker widget (bsc#1192075)\n\npython-lxml:\n\n- CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).\n- CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).\n- CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).\n- CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).\n\nopenstack-barbican:\n\n- CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).\n- CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).\n\ngrafana:\n\n- CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).\n\nopenstack-keystone:\n\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nNon-security fixes included on the update:\n\nChanges in ardana-barbican:\n- Update to version 9.0+git.1644879908.8a641c1:\n  * Update policies to protect container secret access (SOC-11621)\n\n- Update to version 9.0+git.1643052417.9a3348e:\n  * update policies to protect secret metadata access (SOC-11620)\n\nChanges in grafana:\n- Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)\n  * directory traversal vulnerability for .md files \n\n- Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)\n  * Fix Go net/http: limit growth of header canonicalization cache\n\nChanges in openstack-barbican:\n- Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch\n  and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix\n  the legacy policy rules for adding a secret to a container and removing\n  a secret from a container. bsc#1194954,CVE-2022-23452\n\n- Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the\n  legacy policy rules for accessing secret metadata by checking that\n  the user making the request is authenticated for the project that\n  owns the secret. bsc#1194952,CVE-2022-23451\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev4:\n  * Add support for yoga\n\n- Update to version group-based-policy-automation-14.0.1.dev3:\n  * Python2/3 compatibility fixes\n\n- Update to version group-based-policy-automation-14.0.1.dev2:\n  * Add support for xena\n\n- Update to version group-based-policy-automation-14.0.1.dev1:\n  * Remove py27 from gate jobs\n  14.0.0\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev3:\n  * Add support for yoga\n\n- Update to version group-based-policy-ui-14.0.1.dev2:\n  * Python2/3 compatibility changes\n\n- Update to version group-based-policy-ui-14.0.1.dev1:\n  * Add support for xena\n  14.0.0\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-keystone:\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-keystone:\n- Add patch (0001-Hide-AccountLocked-exception-from-end-users.patch) to fix\n  the problem where AccountLocked exception discloses sensitive information.\n  bsc#1189390,CVE-2021-38155\n\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev33:\n  * Populate network mtu for erspan\n\n- Update to version group-based-policy-14.0.1.dev32:\n  * ERSPAN config error when Openstack port is created in a different project than network it belongs to\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev31:\n  * Python2/3 compatibility fixes\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev29:\n  * Fix oslo\\_i18n usage\n\n- Update to version group-based-policy-14.0.1.dev27:\n  * Update mechanism\\_driver cache\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev26:\n  * Add support for xena\n\n- Update to version group-based-policy-14.0.1.dev24:\n  * update\\_floatingip\\_status\\_while\\_deleting\\_the\\_vm\n\n- Update to version group-based-policy-14.0.1.dev22:\n  * Updating host id by appending pid in existing host id\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev20:\n  * Revert 'Add workaround to get\\_subnets'\n\nChanges in python-lxml:\n- Fix bsc#1179534 (CVE-2020-27783)\n  mXSS due to the use of improper parser \n  Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch\n- Fix bsc#1118088 (CVE-2018-19787)\n  lxml/html/clean.py in the lxml.html.clean module does not remove\n  javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks\n  Patch file: 0001-CVE-2018-19787.patch\n- Fix bsc#1184177 (CVE-2021-28957)\n  missing input sanitization for formaction HTML5 attributes may lead to XSS\n  Patch file: 0001-CVE-2021-28957.patch\n- Fix bsc#1193752 (CVE-2021-43818)\n  Cleaner: Remove SVG image data URLs since they can embed script content.\n  Reported as GHSL-2021-1037 and GHSL-2021-1038 \n  Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch\n\nChanges in openstack-neutron-doc:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Remove cve-2021-40085-stable-rocky.patch (merged upstream)\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Add cve-2021-40085-stable-rocky.patch (bsc#1189794, CVE-2021-40085) \n  * Remove dhcp_extra_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in python-Pillow:\n- Add 030-CVE-2022-22817.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22817, bsc#1194521 \n   * test from upstream updated for python2\n\n- Add 028-CVE-2022-22815.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22815, bsc#1194552\n- Add 029-CVE-2022-22816.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22816, bsc#1194551\n\nChanges in python-XStatic-jquery-ui:\n- Update to version 1.13.0.1 (bsc#1192070, CVE-2021-41182, bsc#1192073,\n  CVE-2021-41184, bsc#1192075,  CVE-2021-41183)\n    * Fix XSS in the altField option of the Datepicker widget \n     (CVE-2021-41182)\n    * Fix XSS in *Text options of the Datepicker widget\n     (CVE-2021-41183)\n    * Fix XSS in the of option of the .position() util\n      (CVE-2021-41184)\n    * Drop support for Query 1.7\n    * Accordion: allow function parameter for selecting header\n      elements\n    * Datepicker: add optional onUpdateDatepicker callback\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20220413:\n  * Update release notes to indicate support for SES7\n- Update to version 9.20220112:\n  * Add reference to keystone bcrypt issue to known limitations (bsc#1186380)\n\nChanges in rubygem-sinatra:\n- Add CVE-2022-29970.patch (bsc#1199138, CVE-2022-29970)\n\n  ","status":"published","published":"2022-05-18T14:55:52Z","modified":"2026-02-04T03:56:30.500919Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5387-1","title":"barbican vulnerabilities","description":"Douglas Mendizábal discovered that Barbican incorrectly handled access\nrestrictions. An authenticated attacker could possibly use this issue to\nconsume protected resources and possibly cause a denial of service.\n(CVE-2022-23451, CVE-2022-23452)\n","status":"published","published":"2022-04-25T16:19:10Z","modified":"2026-04-27T16:19:01.465251302Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}