Vulnerability · Published Sep 24, 2023 · Assigned by redhat
CVE-2023-1636Incomplete container isolation
Medium 6.0
In plain English
A medium-severity security flaw in openstack-barbican. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)6.0Medium
Exploit odds (30 days)0.5%top 58.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | barbican | no fix listed | GHSA-6rx9-c2rh-3qv4 |
| PyPI | barbican | no fix listed | PYSEC-2026-1214 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | openstack-barbican | see references |
| Red Hat | Red Hat OpenStack Platform 13 (Queens) | see references |
| Red Hat | Red Hat OpenStack Platform 16.1 | see references |
| Red Hat | Red Hat OpenStack Platform 16.2 | see references |
| Red Hat | Red Hat OpenStack Platform 17.0 | see references |
| RDO | OpenStack RDO | see references |
Weakness: CWE-653 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
References
- https://access.redhat.com/security/cve/CVE-2023-1636 vdb-entry, x_refsource_REDHAT
- RHBZ#2181765 issue-tracking, x_refsource_REDHAT