Publishing details

• Removed from disk on 2022-07-24.
• Removal requested on 2022-07-23.
• Published on 2022-04-25
• Copied from ubuntu impish in PPA for Ubuntu Security Proposed by Rodrigo Figueiredo Zaiden

Changelog

barbican (2:13.0.0-0ubuntu1.2) impish-security; urgency=medium

  * SECURITY UPDATE: Access restrictions bypass
    - debian/patches/CVE-2022-23451-1.patch: Change access policies to
      secret metadata in barbican/common/policies/secretmeta.py. Add a new
      role in barbican/common/policies/base.py and make use of these changes
      in barbican/api/controllers/__init__.py,
      barbican/api/controllers/secretmeta.py and
      barbican/api/controllers/secrets.py.
    - debian/patches/CVE-2022-23451-2.patch: Fix secure RBAC rules in
      barbican/common/policies/secretmeta.py
    - debian/patches/CVE-2022-23451-post1.patch: Change consumer controller
      code in barbican/api/controllers/*, change policy rules in
      barbican/common/policies/consumers.py and add tests in
      barbican/tests/api/test_resources_policy.py and
      functionaltests/api/v1/functional/test_acls.py.
    - debian/patches/CVE-2022-23451-post2.patch: Change secret policies in
      barbican/common/policies/secrets.py, add tests in
      barbican/tests/api/test_resources_policy.py and
      functionaltests/api/v1/functional/test_secrets_rbac.py and update
      api guide in api-guide/source/acls.rst.
    - CVE-2022-23451
  * SECURITY UPDATE: Ownership bypass
    - debian/patches/CVE-2022-23452.patch: Update container secret policies
      in barbican/common/policies/containers.py and add a new role in
      barbican/common/policies/base.py.
    - CVE-2022-23452

 -- Rodrigo Figueiredo Zaiden <email address hidden>  Fri, 08 Apr 2022 15:05:16 -0300

Builds

• amd64

Package files

• barbican-api_13.0.0-0ubuntu1.2_all.deb (2.3 KiB)
• barbican-common_13.0.0-0ubuntu1.2_all.deb (20.0 KiB)
• barbican-doc_13.0.0-0ubuntu1.2_all.deb (1.1 MiB)
• barbican-keystone-listener_13.0.0-0ubuntu1.2_all.deb (5.0 KiB)
• barbican-worker_13.0.0-0ubuntu1.2_all.deb (5.0 KiB)
• barbican_13.0.0-0ubuntu1.2.debian.tar.xz (20.3 KiB)
• barbican_13.0.0-0ubuntu1.2.dsc (4.0 KiB)
• barbican_13.0.0.orig.tar.gz (667.3 KiB)
• python3-barbican_13.0.0-0ubuntu1.2_all.deb (264.6 KiB)