Publishing details

• Removed from disk on 2022-10-26.
• Removal requested on 2022-10-26.
• Superseded on 2022-10-25 by barbican - 1:10.1.0-0ubuntu2.2
• Published on 2022-04-25
• Copied from ubuntu focal in PPA for Ubuntu Security Proposed by Rodrigo Figueiredo Zaiden

Changelog

barbican (1:10.1.0-0ubuntu2.1) focal-security; urgency=medium

  * SECURITY UPDATE: Access restrictions bypass
    - debian/patches/CVE-2022-23451.patch: Change access policies to
      secret metadata in barbican/common/policies/secretmeta.py. Add a new
      role in barbican/common/policies/base.py and make use of these changes
      in barbican/api/controllers/__init__.py,
      barbican/api/controllers/secretmeta.py and
      barbican/api/controllers/secrets.py.
    - debian/patches/CVE-2022-23451-post.patch: Change secret policies in
      barbican/common/policies/secrets.py, add tests in
      barbican/tests/api/test_resources_policy.py and
      functionaltests/api/v1/functional/test_secrets_rbac.py and update
      api guide in api-guide/source/acls.rst.
    - CVE-2022-23451
  * SECURITY UPDATE: Ownership bypass
    - debian/patches/CVE-2022-23452.patch: Update container secret policies
      in barbican/common/policies/containers.py and add a new role in
      barbican/common/policies/base.py.
    - CVE-2022-23452

 -- Rodrigo Figueiredo Zaiden <email address hidden>  Wed, 20 Apr 2022 18:00:29 -0300

Builds

• amd64

Package files

• barbican-api_10.1.0-0ubuntu2.1_all.deb (2.5 KiB)
• barbican-common_10.1.0-0ubuntu2.1_all.deb (19.8 KiB)
• barbican-doc_10.1.0-0ubuntu2.1_all.deb (1.0 MiB)
• barbican-keystone-listener_10.1.0-0ubuntu2.1_all.deb (4.8 KiB)
• barbican-worker_10.1.0-0ubuntu2.1_all.deb (4.8 KiB)
• barbican_10.1.0-0ubuntu2.1.debian.tar.xz (19.1 KiB)
• barbican_10.1.0-0ubuntu2.1.dsc (3.9 KiB)
• barbican_10.1.0.orig.tar.gz (620.0 KiB)
• python3-barbican_10.1.0-0ubuntu2.1_all.deb (260.6 KiB)