CVE catalog

CVE-2022-3100

barbican: CVE-2022-3100

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Published: Sep 28, 2022, 5:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.44% · Oct 25, 2026

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	barbican	sid	`1:23.0.0-4`	fixed
Debian	barbican	forky	`1:23.0.0-4`	fixed
Debian	barbican	trixie	`1:20.0.0-3`	fixed
Debian	barbican	bookworm	`1:15.0.1-2`	fixed
Ubuntu	barbican	18.04	`1:5.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b1-0ubuntu2`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1.1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1.2`	fixed
Ubuntu	barbican	20.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0-0ubuntu0.20.04.3`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2.1`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2.2`	fixed
Ubuntu	barbican	22.04	`2:13.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0-0ubuntu2`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022011215.a9d2b133-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022011215.a9d2b133-0ubuntu2`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022030310.ffea7f79-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:14.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:14.0.0-0ubuntu1.1`	fixed
Suse	openstack-barbican	openstack cloud 9	`7.0.1~dev24-3.17.1`	fixed
Suse	openstack-heat-gbp	openstack cloud 9	`14.0.1~dev5-3.12.1`	fixed
Suse	openstack-horizon-plugin-gbp-ui	openstack cloud 9	`14.0.1~dev6-3.15.1`	fixed
Suse	openstack-neutron	openstack cloud 9	`13.0.8~dev209-3.43.1`	fixed
Suse	openstack-neutron-gbp	openstack cloud 9	`14.0.1~dev52-3.37.1`	fixed
Suse	spark	openstack cloud 9	`2.2.3-5.12.1`	fixed
Suse	venv-openstack-barbican	openstack cloud 9	`7.0.1~dev24-3.37.1`	fixed
Suse	venv-openstack-horizon	openstack cloud 9	`14.1.1~dev11-4.43.1`	fixed
Suse	venv-openstack-neutron	openstack cloud 9	`13.0.8~dev209-6.43.1`	fixed
Suse	venv-openstack-nova	openstack cloud 9	`18.3.1~dev92-3.43.1`	fixed
Suse	openstack-barbican	openstack cloud crowbar 9	`7.0.1~dev24-3.17.1`	fixed
Suse	openstack-heat-gbp	openstack cloud crowbar 9	`14.0.1~dev5-3.12.1`	fixed
Suse	openstack-horizon-plugin-gbp-ui	openstack cloud crowbar 9	`14.0.1~dev6-3.15.1`	fixed
Suse	openstack-neutron	openstack cloud crowbar 9	`13.0.8~dev209-3.43.1`	fixed
Suse	openstack-neutron-gbp	openstack cloud crowbar 9	`14.0.1~dev52-3.37.1`	fixed
Suse	spark	openstack cloud crowbar 9	`2.2.3-5.12.1`	fixed
Suse	openstack-barbican	hpe helion openstack 8	`5.0.2~dev3-3.17.2`	fixed
Suse	openstack-barbican-doc	hpe helion openstack 8	`5.0.2~dev3-3.17.2`	fixed
Suse	venv-openstack-barbican	hpe helion openstack 8	`5.0.2~dev3-12.43.2`	fixed
Suse	openstack-barbican	openstack cloud 8	`5.0.2~dev3-3.17.2`	fixed
Suse	openstack-barbican-doc	openstack cloud 8	`5.0.2~dev3-3.17.2`	fixed
Suse	venv-openstack-barbican	openstack cloud 8	`5.0.2~dev3-12.43.2`	fixed
Suse	openstack-barbican	openstack cloud crowbar 8	`5.0.2~dev3-3.17.2`	fixed
Suse	openstack-barbican-doc	openstack cloud crowbar 8	`5.0.2~dev3-3.17.2`	fixed
Ubuntu	barbican	16.04	`1:1.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~b2-0ubuntu2`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~b2-0ubuntu3`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	16.04	`1:2.0.0-0ubuntu1.1`	vulnerable
Ubuntu	barbican	18.04	`1:5.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b1-0ubuntu2`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b2-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~b3-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1.1`	vulnerable
Ubuntu	barbican	18.04	`1:6.0.1-0ubuntu1.2`	fixed
Ubuntu	barbican	20.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu2`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0~b2~git2020020508.7b14d983-0ubuntu3`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	barbican	20.04	`1:10.0.0-0ubuntu0.20.04.3`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu1`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2.1`	vulnerable
Ubuntu	barbican	20.04	`1:10.1.0-0ubuntu2.2`	fixed
Ubuntu	barbican	22.04	`2:13.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0-0ubuntu2`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022011215.a9d2b133-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022011215.a9d2b133-0ubuntu2`	vulnerable
Ubuntu	barbican	22.04	`2:13.0.0+git2022030310.ffea7f79-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:14.0.0-0ubuntu1`	vulnerable
Ubuntu	barbican	22.04	`2:14.0.0-0ubuntu1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	barbican	source	sid	`1:15.0.0~rc3-1`	not yet assigned	Not reported	[1021139]
Debian	barbican	source	forky	`1:15.0.0~rc3-1`	not yet assigned	Not reported	[1021139]
Debian	barbican	source	trixie	`1:15.0.0~rc3-1`	not yet assigned	Not reported	[1021139]
Debian	barbican	source	bookworm	`1:15.0.0~rc3-1`	not yet assigned	Not reported	[1021139]
Ubuntu	barbican	deb	18.04	`1:6.0.1-0ubuntu1.2`	Not reported	USN-5697-1	Not reported
Ubuntu	barbican	deb	20.04	`1:10.1.0-0ubuntu2.2`	Not reported	USN-5697-1	Not reported
Ubuntu	barbican	deb	22.04	`2:14.0.0-0ubuntu1.1`	Not reported	USN-5697-1	Not reported
Suse	openstack-barbican	rpm	openstack cloud 9	`7.0.1~dev24-3.17.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-heat-gbp	rpm	openstack cloud 9	`14.0.1~dev5-3.12.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-horizon-plugin-gbp-ui	rpm	openstack cloud 9	`14.0.1~dev6-3.15.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-neutron	rpm	openstack cloud 9	`13.0.8~dev209-3.43.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-neutron-gbp	rpm	openstack cloud 9	`14.0.1~dev52-3.37.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	spark	rpm	openstack cloud 9	`2.2.3-5.12.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	venv-openstack-barbican	rpm	openstack cloud 9	`7.0.1~dev24-3.37.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	venv-openstack-horizon	rpm	openstack cloud 9	`14.1.1~dev11-4.43.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	venv-openstack-neutron	rpm	openstack cloud 9	`13.0.8~dev209-6.43.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	venv-openstack-nova	rpm	openstack cloud 9	`18.3.1~dev92-3.43.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-barbican	rpm	openstack cloud crowbar 9	`7.0.1~dev24-3.17.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-heat-gbp	rpm	openstack cloud crowbar 9	`14.0.1~dev5-3.12.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-horizon-plugin-gbp-ui	rpm	openstack cloud crowbar 9	`14.0.1~dev6-3.15.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-neutron	rpm	openstack cloud crowbar 9	`13.0.8~dev209-3.43.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-neutron-gbp	rpm	openstack cloud crowbar 9	`14.0.1~dev52-3.37.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	spark	rpm	openstack cloud crowbar 9	`2.2.3-5.12.1`	Not reported	SUSE-SU-2023:0070-1	Not reported
Suse	openstack-barbican	rpm	hpe helion openstack 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	openstack-barbican-doc	rpm	hpe helion openstack 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	venv-openstack-barbican	rpm	hpe helion openstack 8	`5.0.2~dev3-12.43.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	openstack-barbican	rpm	openstack cloud 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	openstack-barbican-doc	rpm	openstack cloud 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	venv-openstack-barbican	rpm	openstack cloud 8	`5.0.2~dev3-12.43.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	openstack-barbican	rpm	openstack cloud crowbar 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Suse	openstack-barbican-doc	rpm	openstack cloud crowbar 8	`5.0.2~dev3-3.17.2`	Not reported	SUSE-SU-2023:0071-1	Not reported
Ubuntu	barbican	deb	18.04	`1:6.0.1-0ubuntu1.2`	Not reported	UBUNTU-CVE-2022-3100	Not reported
Ubuntu	barbican	deb	20.04	`1:10.1.0-0ubuntu2.2`	Not reported	UBUNTU-CVE-2022-3100	Not reported
Ubuntu	barbican	deb	22.04	`2:14.0.0-0ubuntu1.1`	Not reported	UBUNTU-CVE-2022-3100	Not reported

[Debian bug #1021139]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[barbican-api]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
[barbican-common]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
[barbican-doc]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
[barbican-keystone-listener]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
[barbican-worker]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
[python3-barbican]Fixed
Source package: [barbican]
Details (2)
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm
- 1:15.0.1-2 · all · bookworm
  Fixed · Fixed: 1:15.0.0~rc3-1
  dsa · barbican · debian · bookworm

Observed: Oct 23, 2026, 6:26:50 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]