CVE-2019-10138 Improper Access Control in novajoin
HighCVSS 8.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi novajoin(PyPI) | < 1.1.1 | 1.1.1 |
| pypi novajoin(PyPI) | = 1.0.10 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.11 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.12 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.13 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.14 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.15 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.16 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.17 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.18 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.19 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.20 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.21 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.22 | No fix listed |
| pypi novajoin(PyPI) | = 1.0.9 | No fix listed |
| pypi novajoin(PyPI) | = 1.1.0 | No fix listed |
| pypi novajoin(PyPI) | <= 1.1.0 | No fix listed |
| python novajoin | < 1.1.1 | 1.1.1 |
| redhat python-novajoin | = all up to, excluding 1.1.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com product
- github.com
- review.opendev.org third-party-advisory
- github.com vendor-advisory