Bug 2181761 (CVE-2023-1633)
| Summary: | CVE-2023-1633 openstack-barbican: Insecure Barbican configuration file leaking credential | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Nick Tait <ntait> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | alee, carnil, dmendiza, eglynn, ggrasza, jjoyce, jjung, lhh, mburns, mgarciac, spower, ytale |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gaining access to sensitive credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2183655, 2183656, 2183657, 2188734 | ||
| Bug Blocks: | 2170395 | ||
|
Description
Nick Tait
2023-03-25 17:50:26 UTC
Created openstack-barbican tracking bugs for this issue: Affects: openstack-rdo [bug 2188734] Hi, (In reply to Nick Tait from comment #0) > A barbican configuration file is set to world-readable in Red Hat OpenStack. > This presents a security risk as it allows authenticated attacker with > limited access to the file to view its contents, including secure credential. I'm trying to triage this CVE (CVE-2023-1633) for a downstream distribution but this bugzilla entry was the only cross-reference available. Can you share more on the CVE, does it affect upstream barbican and was it reported there? Can you provide more information on it? Regards, Salvatore Yes, sorry for the sparse content at this stage. This is very likely the first public reference to this issue (along with CVE-2023-1636). Both issues came via the same reporter. I believe they both only affect downstream RHOSP. I'm following up with the reporter to get more details. (Will not clear the needinfos as a reminder to myself) Hi Nick, (In reply to Nick Tait from comment #5) > Yes, sorry for the sparse content at this stage. This is very likely the > first public reference to this issue (along with CVE-2023-1636). Both issues > came via the same reporter. I believe they both only affect downstream > RHOSP. I'm following up with the reporter to get more details. (Will not > clear the needinfos as a reminder to myself) I see the needinfo was canclelled, did you got more information on this (and as you correctly pointed out CVE-2023-1636) issues? Thank you already! Regards, Salvatore Still waiting on reporter, but I did send them a reminder. Feel free to send me another needinfo in a few days... Hi Nick, (In reply to Nick Tait from comment #9) > Still waiting on reporter, but I did send them a reminder. Feel free to send > me another needinfo in a few days... Any news on this and on the other barbican issue? Thanks for following up, unfortunately I never received any additional details. This issue has been addressed in the following products: Red Hat OpenStack Platform 16.2 Via RHSA-2023:6231 https://access.redhat.com/errata/RHSA-2023:6231 |