{"id":"CVE-2022-23452","aliases":["DEBIAN-CVE-2022-23452","EUVD-2022-6721","GHSA-6p2h-rjj7-2j63","PYSEC-2026-785","RHSA-2022:5114","RHSA-2022:8874","SUSE-SU-2022:1729-1","UBUNTU-CVE-2022-23452","USN-5387-1"],"status":"published","title":"openstack-barbican Denial of Service vulnerability","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01294,"percentile":0.7055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-01-28T00:00:00Z","modified":"2026-11-03T08:03:49Z","fixes":[{"ecosystem":"PyPI","package":"barbican","fixed_in":["14.0.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"barbican","fixed_in":["1:14.0.0~rc1-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"barbican","fixed_in":["1:6.0.1-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"barbican","fixed_in":["1:10.1.0-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:14.0.0~rc1-2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.0"}]}],"versions":["0","10.0.0","10.0.0.0rc1","10.1.0","11.0.0","11.0.0.0rc1","12.0.0","12.0.0.0rc1","12.0.0.0rc2","12.0.1","12.0.2","13.0.0","13.0.0.0rc1","13.0.1","13.0.2","14.0.0.0rc1","6.0.0.0b1","8.0.0","8.0.0.0rc1","8.0.1","9.0.0","9.0.0.0rc1","9.0.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-keystone-listener","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185348.c718783.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-keystone-listener","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-worker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220916133702.07be198.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1644879908.8a641c1-3.13.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.35.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.38.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-4.33.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.36.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.41.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.37.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-6.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev91-3.39.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.35.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.26.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.14.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev24-3.34.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev4-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev3-3.9.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev18-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev9-3.28.2"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev206-3.40.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev33-3.31.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-3.17.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-XStatic-jquery-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0.1-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.4-3.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20220413-3.30.1"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-sinatra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-4.3.1"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.1"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.1"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2"],"bundled":2}],"products":[{"vendor":"openstack","product":"barbican"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025090","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2022908","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Permissions Required","Third Party Advisory","report","web"]},{"url":"https://storyboard.openstack.org/#%21/story/2009297","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://review.opendev.org/c/openstack/barbican/+/814200","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23452","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23452","tags":["advisory"]},{"url":"https://storyboard.openstack.org/#!/story/2009297","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:5114","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:8874","tags":["web","advisory"]},{"url":"https://github.com/openstack/barbican/commit/6c841b23afa8ed6fa4cd01ba1a6bebfb60f06ae5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6p2h-rjj7-2j63","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23452.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-23452","tags":["advisory"]},{"url":"https://pypi.org/project/barbican","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025089","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5114.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23451","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23451","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23451","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23452","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1965086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2025979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026029","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8874.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1118088","tags":["report"]},{"url":"https://bugzilla.suse.com/1179534","tags":["report"]},{"url":"https://bugzilla.suse.com/1184177","tags":["report"]},{"url":"https://bugzilla.suse.com/1186380","tags":["report"]},{"url":"https://bugzilla.suse.com/1189390","tags":["report"]},{"url":"https://bugzilla.suse.com/1189794","tags":["report"]},{"url":"https://bugzilla.suse.com/1192070","tags":["report"]},{"url":"https://bugzilla.suse.com/1192073","tags":["report"]},{"url":"https://bugzilla.suse.com/1192075","tags":["report"]},{"url":"https://bugzilla.suse.com/1193597","tags":["report"]},{"url":"https://bugzilla.suse.com/1193688","tags":["report"]},{"url":"https://bugzilla.suse.com/1193752","tags":["report"]},{"url":"https://bugzilla.suse.com/1194521","tags":["report"]},{"url":"https://bugzilla.suse.com/1194551","tags":["report"]},{"url":"https://bugzilla.suse.com/1194552","tags":["report"]},{"url":"https://bugzilla.suse.com/1194952","tags":["report"]},{"url":"https://bugzilla.suse.com/1194954","tags":["report"]},{"url":"https://bugzilla.suse.com/1199138","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-38155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-22817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29970","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-23452","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5387-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-23451","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-23452","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-01T20:57:45Z","modified":"2024-08-03T03:43:45.996Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-6721","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-01T20:57:45Z","modified":"2024-08-03T03:43:45Z","updated_at":"2026-11-03T03:25:51.181739Z"}],"ghsa":[{"id":"GHSA-6p2h-rjj7-2j63","title":"openstack-barbican Denial of Service vulnerability","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-02T00:01:02Z","modified":"2024-05-14T21:21:49Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2022-23452","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-01T21:15:09.173Z","modified":"2026-06-17T04:30:09.057Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:26.802986Z"}],"osv":[{"id":"DEBIAN-CVE-2022-23452","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-01T21:15:09.173Z","modified":"2026-11-03T08:03:49.847568528Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:23:57.167851Z"},{"id":"GHSA-6p2h-rjj7-2j63","title":"openstack-barbican Denial of Service vulnerability","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-02T00:01:02Z","modified":"2026-07-07T11:56:16.329461124Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"PYSEC-2026-785","title":"openstack-barbican Denial of Service vulnerability","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2026-07-06T08:03:32.391529Z","modified":"2026-07-07T11:45:43.103635799Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2022:5114","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (openstack-barbican) security update","status":"published","published":"2024-09-16T08:25:26Z","modified":"2026-08-08T10:02:04Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2022:8874","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (openstack-barbican) security update","status":"published","published":"2024-09-16T08:25:33Z","modified":"2026-08-08T10:02:21Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-23452","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-01-28T00:00:00Z","modified":"2026-02-04T03:51:24.349038Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"CVE-2022-23452","description":"An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container. This flaw allows an attacker on the network to consume protected resources and cause a denial of service.","status":"published","published":"2022-09-01T20:57:45Z","modified":"2026-10-28T02:30:39.237532321Z","cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:24.061177Z"},{"id":"SUSE-SU-2022:1729-1","title":"Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud","description":"This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:\n\nSecurity fixes included on the update:\n\nardana-barbican:\n\n- Update policies to protect container secret access (SOC-11621)\n- Update policies to protect secret metadata access (SOC-11620)\n\nopenstack-neutron:\n\n- CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).\n\nrubygem-sinatra:\n\n- CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).\n\npython-XStatic-jquery-ui:\n\n- CVE-2021-41182: Fixed XSS in the `altField` option of the Datepicker widget (bsc#1192070)\n- CVE-2021-41183: Fixed XSS in the `of` option of the `.position()` util (bsc#1192073)\n- CVE-2021-41184: Fixed XSS in `*Text` options of the Datepicker widget (bsc#1192075)\n\npython-lxml:\n\n- CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).\n- CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).\n- CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).\n- CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).\n\nopenstack-barbican:\n\n- CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).\n- CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).\n\ngrafana:\n\n- CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).\n\nopenstack-keystone:\n\n- CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).\n\nNon-security fixes included on the update:\n\nChanges in ardana-barbican:\n- Update to version 9.0+git.1644879908.8a641c1:\n  * Update policies to protect container secret access (SOC-11621)\n\n- Update to version 9.0+git.1643052417.9a3348e:\n  * update policies to protect secret metadata access (SOC-11620)\n\nChanges in grafana:\n- Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)\n  * directory traversal vulnerability for .md files \n\n- Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)\n  * Fix Go net/http: limit growth of header canonicalization cache\n\nChanges in openstack-barbican:\n- Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch\n  and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix\n  the legacy policy rules for adding a secret to a container and removing\n  a secret from a container. bsc#1194954,CVE-2022-23452\n\n- Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the\n  legacy policy rules for accessing secret metadata by checking that\n  the user making the request is authenticated for the project that\n  owns the secret. bsc#1194952,CVE-2022-23451\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev24:\n  * Correct group:reset\\_group\\_snapshot\\_status policy\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev4:\n  * Add support for yoga\n\n- Update to version group-based-policy-automation-14.0.1.dev3:\n  * Python2/3 compatibility fixes\n\n- Update to version group-based-policy-automation-14.0.1.dev2:\n  * Add support for xena\n\n- Update to version group-based-policy-automation-14.0.1.dev1:\n  * Remove py27 from gate jobs\n  14.0.0\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev3:\n  * Add support for yoga\n\n- Update to version group-based-policy-ui-14.0.1.dev2:\n  * Python2/3 compatibility changes\n\n- Update to version group-based-policy-ui-14.0.1.dev1:\n  * Add support for xena\n  14.0.0\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev18:\n  * Cleanup stable/rocky legacy jobs\n\nChanges in openstack-keystone:\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-keystone:\n- Add patch (0001-Hide-AccountLocked-exception-from-end-users.patch) to fix\n  the problem where AccountLocked exception discloses sensitive information.\n  bsc#1189390,CVE-2021-38155\n\n- Update to version keystone-14.2.1.dev9:\n  * Delete system role assignments from system\\_assignment table\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev33:\n  * Populate network mtu for erspan\n\n- Update to version group-based-policy-14.0.1.dev32:\n  * ERSPAN config error when Openstack port is created in a different project than network it belongs to\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev31:\n  * Python2/3 compatibility fixes\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev29:\n  * Fix oslo\\_i18n usage\n\n- Update to version group-based-policy-14.0.1.dev27:\n  * Update mechanism\\_driver cache\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev26:\n  * Add support for xena\n\n- Update to version group-based-policy-14.0.1.dev24:\n  * update\\_floatingip\\_status\\_while\\_deleting\\_the\\_vm\n\n- Update to version group-based-policy-14.0.1.dev22:\n  * Updating host id by appending pid in existing host id\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev20:\n  * Revert 'Add workaround to get\\_subnets'\n\nChanges in python-lxml:\n- Fix bsc#1179534 (CVE-2020-27783)\n  mXSS due to the use of improper parser \n  Patch files: 0001-CVE-2020-27783.patch 0002-CVE-2020-27783.patch\n- Fix bsc#1118088 (CVE-2018-19787)\n  lxml/html/clean.py in the lxml.html.clean module does not remove\n  javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks\n  Patch file: 0001-CVE-2018-19787.patch\n- Fix bsc#1184177 (CVE-2021-28957)\n  missing input sanitization for formaction HTML5 attributes may lead to XSS\n  Patch file: 0001-CVE-2021-28957.patch\n- Fix bsc#1193752 (CVE-2021-43818)\n  Cleaner: Remove SVG image data URLs since they can embed script content.\n  Reported as GHSL-2021-1037 and GHSL-2021-1038 \n  Patch files 0001-CVE-2021-43818.patch 0002-CVE-2021-43818.patch\n\nChanges in openstack-neutron-doc:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev206:\n  * Wait longer before deleting DPDK vhu trunk bridges\n\n- Update to version neutron-13.0.8.dev205:\n  * Do no use '--strict' for OF deletion in TRANSIENT\\_TABLE\n\n- Update to version neutron-13.0.8.dev203:\n  * Populate self.floating\\_ips\\_dict using 'ip rule' information\n\n- Update to version neutron-13.0.8.dev201:\n  * [Functional] Wait for the initial state of ha router before test\n  * Don't setup bridge controller if it is already set\n\n- Update to version neutron-13.0.8.dev198:\n  * Remove dhcp\\_extra\\_opt name after first newline character\n\n- Update to version neutron-13.0.8.dev196:\n  * [L3] Use processing queue for network update events\n  * Add extra logs to the network update callback in L3 agent\n\n- Remove cve-2021-40085-stable-rocky.patch (merged upstream)\n\n- Update to version neutron-13.0.8.dev192:\n  * Remove dhcp\\_extra\\_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev190:\n  * Don't use singleton in routes.middleware.RoutesMiddleware\n\n- Update to version neutron-13.0.8.dev189:\n  * Fix notify listener syntax for SEGMENT\\_HOST\\_MAPPING\n\n- Add cve-2021-40085-stable-rocky.patch (bsc#1189794, CVE-2021-40085) \n  * Remove dhcp_extra_opt value after first newline character\n\n- Update to version neutron-13.0.8.dev188:\n  * Clean port forwarding cache when router is DOWN\n\n- Update to version neutron-13.0.8.dev186:\n  * Remove FIP agent's gw port when L3 agent is deleted\n\n- Update to version neutron-13.0.8.dev184:\n  * Force to close http connection after notify about HA router status\n\n- Update to version neutron-13.0.8.dev183:\n  * Don't configure dnsmasq entries for 'network' ports\n\n- Update to version neutron-13.0.8.dev181:\n  * Exclude fallback tunnel devices from netns cleanup\n\n- Update to version neutron-13.0.8.dev180:\n  * [DVR] Send allowed address pairs info to the L3 agents\n  * designate: allow PTR zone creation to fail\n  * Don't try to create default SG when security groups are disabled\n\n- Update to version neutron-13.0.8.dev174:\n  * Fix update of trunk subports during live migration\n\n- Update to version neutron-13.0.8.dev172:\n  * [ovs fw] Restrict IPv6 NA and DHCP(v6) IP and MAC source addresses\n\n- Update to version neutron-13.0.8.dev170:\n  * Call install\\_ingress\\_direct\\_goto\\_flows() when ovs restarts\n\n- Update to version neutron-13.0.8.dev168:\n  * Fix multicast traffic with IGMP snooping enabled\n\n- Update to version neutron-13.0.8.dev166:\n  * Fix OVS conjunctive IP flows cleanup\n\nChanges in python-Pillow:\n- Add 030-CVE-2022-22817.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22817, bsc#1194521 \n   * test from upstream updated for python2\n\n- Add 028-CVE-2022-22815.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22815, bsc#1194552\n- Add 029-CVE-2022-22816.patch\n   * From upstream, backported\n   * Fixes CVE-2022-22816, bsc#1194551\n\nChanges in python-XStatic-jquery-ui:\n- Update to version 1.13.0.1 (bsc#1192070, CVE-2021-41182, bsc#1192073,\n  CVE-2021-41184, bsc#1192075,  CVE-2021-41183)\n    * Fix XSS in the altField option of the Datepicker widget \n     (CVE-2021-41182)\n    * Fix XSS in *Text options of the Datepicker widget\n     (CVE-2021-41183)\n    * Fix XSS in the of option of the .position() util\n      (CVE-2021-41184)\n    * Drop support for Query 1.7\n    * Accordion: allow function parameter for selecting header\n      elements\n    * Datepicker: add optional onUpdateDatepicker callback\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20220413:\n  * Update release notes to indicate support for SES7\n- Update to version 9.20220112:\n  * Add reference to keystone bcrypt issue to known limitations (bsc#1186380)\n\nChanges in rubygem-sinatra:\n- Add CVE-2022-29970.patch (bsc#1199138, CVE-2022-29970)\n\n  ","status":"published","published":"2022-05-18T14:55:52Z","modified":"2026-02-04T03:56:30.500919Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5387-1","title":"barbican vulnerabilities","description":"Douglas Mendizábal discovered that Barbican incorrectly handled access\nrestrictions. An authenticated attacker could possibly use this issue to\nconsume protected resources and possibly cause a denial of service.\n(CVE-2022-23451, CVE-2022-23452)\n","status":"published","published":"2022-04-25T16:19:10Z","modified":"2026-04-27T16:19:01.465251302Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}