Medium severity · published Sep 24, 2023
CVE-2023-1636
A vulnerability was found in OpenStack Barbican containers
5.0
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
Barbican · Openstack
All versions, or not specified · source: NVD
OP
Openstack Platform · Redhat
16.1; 16.2; 17.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1636
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1636
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-1636
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2181765
More from Barbican
8.1
CVE-2022-23451
An authorization flaw was found in openstack-barbican
5.9
CVE-2022-3100
A flaw was found in the openstack-barbican component
5.5
CVE-2023-1633
A credentials leak flaw was found in OpenStack Barbican
4.9
CVE-2022-23452
An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container