A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.
The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Barbican | Openstack | - (including) | - (including) |
| Red Hat OpenStack Platform 13.0 - ELS | RedHat | openstack-barbican-0:6.0.1-6.el7ost | * |
| Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS | RedHat | openstack-barbican-0:6.0.1-6.el7ost | * |
| Red Hat OpenStack Platform 16.1 | RedHat | openstack-barbican-0:9.0.1-1.20220112203416.07be198.el8ost | * |
| Red Hat OpenStack Platform 16.2 | RedHat | openstack-barbican-0:9.0.2-2.20220122185349.c718783.el8ost | * |
| Red Hat OpenStack Platform 17.0 | RedHat | openstack-barbican-0:12.0.1-0.20220614210405.486e607.el9ost | * |
| Barbican | Ubuntu | bionic | * |
| Barbican | Ubuntu | esm-apps/xenial | * |
| Barbican | Ubuntu | focal | * |
| Barbican | Ubuntu | jammy | * |
| Barbican | Ubuntu | trusty | * |
| Barbican | Ubuntu | xenial | * |