GHSA-6rx9-c2rh-3qv4

OpenStack Barbican information disclosure vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-1636

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	barbican	<= 16.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1636 advisory
https://access.redhat.com/security/cve/CVE-2023-1636 web
https://bugzilla.redhat.com/show_bug.cgi?id=2181765 web
https://github.com/openstack/barbican package