CVE-2023-1636: Incomplete container isolation
A container isolation flaw was discovered in Red Hat OpenStack, allowing an attacker with limited authentication and access to Barbican containers to potentially access other OpenStack containers and services. This is possible as they share common CGROUP and namespace.
Other sources
A vulnerability was found in OpenStack Barbican containers. This vulnerability is only applicable to deployments that utilize an all-in-one configuration. Barbican containers share the same CGROUP, USER, and NET namespace with the host system and other OpenStack services. If any service is compromised, it could gain access to the data transmitted to and from Barbican.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this OpenStack Barbican vulnerability?
The vulnerability ID for this OpenStack Barbican vulnerability is CVE-2023-1636.
What is the severity of CVE-2023-1636?
The severity of CVE-2023-1636 is medium (6 out of 10).
Which versions of OpenStack Barbican are affected by CVE-2023-1636?
Versions up to and including 16.0.0 of OpenStack Barbican are affected by CVE-2023-1636.
How is the vulnerability CVE-2023-1636 exploited?
The vulnerability CVE-2023-1636 is exploited when an attacker compromises any service within the same CGROUP, USER, and NET namespace as the Barbican containers.
Are there any references for CVE-2023-1636?
Yes, you can find references for CVE-2023-1636 at the following links: [link1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2188735), [link2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2181765#c0), [link3](https://access.redhat.com/security/cve/CVE-2023-1636).