{"id":"CVE-2022-3100","aliases":["DEBIAN-CVE-2022-3100","DLA-3136-1","DSA-5247-1","EUVD-2022-42529","GHSA-5hg3-ffv7-g5ff","RHSA-2022:6750","SUSE-SU-2023:0070-1","SUSE-SU-2023:0071-1","UBUNTU-CVE-2022-3100","USN-5697-1"],"status":"published","title":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass...","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00449,"percentile":0.39253,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-305"],"published":"2022-09-29T00:00:00Z","modified":"2026-11-03T08:01:17Z","fixes":[{"ecosystem":"Debian:12","package":"barbican","fixed_in":["1:15.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"barbican","fixed_in":["1:15.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"barbican","fixed_in":["1:15.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"barbican","fixed_in":["1:7.0.0-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"barbican","fixed_in":["1:11.0.0-3+deb11u1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican","fixed_in":["0:6.0.1-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican-api","fixed_in":["0:6.0.1-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican-common","fixed_in":["0:6.0.1-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican","fixed_in":["0:9.0.1-1.20220112203416.07be198.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-api","fixed_in":["0:9.0.1-1.20220112203416.07be198.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-common","fixed_in":["0:9.0.1-1.20220112203416.07be198.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-barbican","fixed_in":["0:9.0.1-1.20220112203416.07be198.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","fixed_in":["0:9.0.2-2.20220122185349.c718783.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-api","fixed_in":["0:9.0.2-2.20220122185349.c718783.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-common","fixed_in":["0:9.0.2-2.20220122185349.c718783.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-barbican","fixed_in":["0:9.0.2-2.20220122185349.c718783.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican","fixed_in":["0:12.0.1-0.20220614210405.486e607.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican-api","fixed_in":["0:12.0.1-0.20220614210405.486e607.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican-common","fixed_in":["0:12.0.1-0.20220614210405.486e607.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-barbican","fixed_in":["0:12.0.1-0.20220614210405.486e607.el9ost"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-barbican","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-barbican-doc","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-barbican","fixed_in":["5.0.2~dev3-12.43.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-barbican","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-barbican-doc","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-barbican","fixed_in":["5.0.2~dev3-12.43.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-barbican","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-barbican-doc","fixed_in":["5.0.2~dev3-3.17.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"barbican","fixed_in":["1:6.0.1-0ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"barbican","fixed_in":["1:10.1.0-0ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"barbican","fixed_in":["2:14.0.0-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:15.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.0.0-1+deb10u1"}]}],"versions":["1:7.0.0-1"]},{"source":"osv","ecosystem":"Debian:11","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.0.0-3+deb11u1"}]}],"versions":["1:11.0.0-3"]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.1-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220112203416.07be198.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220112203416.07be198.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220112203416.07be198.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.1-1.20220112203416.07be198.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185349.c718783.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185349.c718783.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185349.c718783.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-2.20220122185349.c718783.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.0.1-0.20220614210405.486e607.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.0.1-0.20220614210405.486e607.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"openstack-barbican-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.0.1-0.20220614210405.486e607.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.0::el9","package":"python3-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.0.1-0.20220614210405.486e607.el9ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev6-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev209-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev52-3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev209-6.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev92-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev5-3.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev6-3.15.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev209-3.43.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.1~dev52-3.37.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-barbican-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.43.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-barbican-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-12.43.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-barbican-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~dev3-3.17.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.0.0-0ubuntu1","1:2.0.0~b1-0ubuntu1","1:2.0.0~b2-0ubuntu1","1:2.0.0~b2-0ubuntu2","1:2.0.0~b2-0ubuntu3","1:2.0.0~b3-0ubuntu1","1:2.0.0~rc1-0ubuntu1","1:2.0.0-0ubuntu1","1:2.0.0-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.2"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1","1:6.0.1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.2"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2","1:10.1.0-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.0.0-0ubuntu1.1"}]}],"versions":["2:13.0.0-0ubuntu1","2:13.0.0-0ubuntu2","2:13.0.0+git2022011215.a9d2b133-0ubuntu1","2:13.0.0+git2022011215.a9d2b133-0ubuntu2","2:13.0.0+git2022030310.ffea7f79-0ubuntu1","2:14.0.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.0.1-0ubuntu1.2"}]}],"versions":["1:5.0.0-0ubuntu1","1:6.0.0~b1-0ubuntu1","1:6.0.0~b1-0ubuntu2","1:6.0.0~b2-0ubuntu1","1:6.0.0~b3-0ubuntu1","1:6.0.0~rc1-0ubuntu1","1:6.0.0-0ubuntu1","1:6.0.1-0ubuntu1","1:6.0.1-0ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.0-0ubuntu2.2"}]}],"versions":["1:9.0.0-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2","1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3","1:10.0.0-0ubuntu0.20.04.1","1:10.0.0-0ubuntu0.20.04.3","1:10.1.0-0ubuntu1","1:10.1.0-0ubuntu2","1:10.1.0-0ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:14.0.0-0ubuntu1.1"}]}],"versions":["2:13.0.0-0ubuntu1","2:13.0.0-0ubuntu2","2:13.0.0+git2022011215.a9d2b133-0ubuntu1","2:13.0.0+git2022011215.a9d2b133-0ubuntu2","2:13.0.0+git2022030310.ffea7f79-0ubuntu1","2:14.0.0-0ubuntu1"]}],"products":[{"vendor":"openstack","product":"barbican"},{"vendor":"red hat","product":"red hat openstack platform"},{"vendor":"redhat","product":"openstack"},{"vendor":"redhat","product":"openstack_for_ibm_power"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2022-3100","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3100","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5hg3-ffv7-g5ff"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3100.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3100","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6750","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125404","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6750.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3100","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230070-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203873","tags":["report"]},{"url":"https://bugzilla.suse.com/1204326","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-33891","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230071-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3100","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5697-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3100","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T00:00:00Z","modified":"2025-04-03T19:26:10.275Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42529","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T00:00:00Z","modified":"2025-04-03T19:26:10Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:43.340305Z"}],"ghsa":[{"id":"GHSA-5hg3-ffv7-g5ff","title":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass...","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T18:30:16Z","modified":"2023-02-03T05:06:58Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:53:57.970783Z"}],"nvd":[{"id":"CVE-2022-3100","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T17:15:10.173Z","modified":"2026-06-17T04:58:51.457Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T14:07:35.157734Z"}],"osv":[{"id":"CVE-2022-3100","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T00:00:00Z","modified":"2026-10-28T02:30:43.759126462Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-305"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"DEBIAN-CVE-2022-3100","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2023-01-18T17:15:10.173Z","modified":"2026-11-03T08:01:17.286070263Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"RHSA-2022:6750","title":"Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-barbican) security update","status":"published","published":"2024-09-13T21:02:13Z","modified":"2026-10-08T10:03:05Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"},{"id":"UBUNTU-CVE-2022-3100","description":"A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.","status":"published","published":"2022-09-29T00:00:00Z","modified":"2026-02-04T02:18:51.750399Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"DLA-3136-1","title":"barbican - security update","status":"published","published":"2022-10-04T00:00:00Z","modified":"2026-03-09T01:19:04.107177Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5247-1","title":"barbican - security update","status":"published","published":"2022-10-04T00:00:00Z","modified":"2026-03-09T02:10:47.444486Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"SUSE-SU-2023:0070-1","title":"Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp","description":"This update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp fixes the following issues:\n\nSecurity fixes included on this update:\n\nopenstack-barbican:\n\n- CVE-2022-3100: Fixed an access policy bypass via query string injection (bsc#1203873).\n\nspark:\n\n- CVE-2022-33891: Fixed a command injection vulnerability via Spark UI (bsc#1204326).\n\n\nNon Security fixes:\n\nChanges in openstack-barbican:\n- Add patch to address access policy bypass via  query string injection.\n  (bsc#1203873, CVE-2022-3100.)\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-14.0.1.dev5:\n  * Add support for zed\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-14.0.1.dev6:\n  * Add support for zed\n\n- Update to version group-based-policy-ui-14.0.1.dev5:\n  * fix launch instance GBP issue\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev209:\n  * Update documentation link for openSUSE index\n\n- Update to version neutron-13.0.8.dev208:\n  * fix: Fix url of Floodlight\n\n- Update to version neutron-13.0.8.dev207:\n  * Mellanox\\_eth.img url expires, remove the mellanox\\_eth.img node\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev209:\n  * Update documentation link for openSUSE index\n\n- Update to version neutron-13.0.8.dev208:\n  * fix: Fix url of Floodlight\n\n- Update to version neutron-13.0.8.dev207:\n  * Mellanox\\_eth.img url expires, remove the mellanox\\_eth.img node\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-14.0.1.dev52:\n  * Fix keystone notification listener\n\n- Update to version group-based-policy-14.0.1.dev51:\n  * Support for epg subnet\n  2014.2.0rc1\n\n- Update to version group-based-policy-14.0.1.dev50:\n  * Use top-level contract references\n  2014.2.rc1\n\n- Update to version group-based-policy-14.0.1.dev48:\n  * Remove py37 jobs from gate\n  2014.2rc1\n\nChanges in spark:\n- Avoid using bash -c in ShellBasedGroupsMappingProvider. (bsc#1204326, CVE-2022-33891)\n\n- Add _constraints to prevent build from running out of disk space\n\n- Update to version group-based-policy-14.0.1.dev47:\n  * Remove python39 from voting\n\n  ","status":"published","published":"2023-01-11T14:40:56Z","modified":"2026-02-04T02:48:42.059854Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0071-1","title":"Security update for openstack-barbican","description":"This update for openstack-barbican contains the following fix:\n\nSecurity fix included on this update:\nopenstack-barbican:\n\n- CVE-2022-3100: Fixed an access policy bypass via query string injection (bsc#1203873).\n\nUpdate for openstack-barbican:\n- Add patch for CVE-2022-3100 to address access policy bypass via query string injection. (bsc#1203873, CVE-2022-3100)\n  ","status":"published","published":"2023-01-11T14:41:08Z","modified":"2026-02-04T02:45:59.745084Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5697-1","title":"barbican vulnerability","description":"Douglas Mendizabal discovered that Barbican incorrectly handled certain\nquery strings. A remote attacker could possibly use this issue to bypass\nthe access policy.\n","status":"published","published":"2022-10-25T11:18:14Z","modified":"2026-04-27T16:24:08.480078Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}