CVE-2019-10138

Advisory

[This advisory has been limited. Please create a free account to view the full advisory.]

Affected package

Affected versions

[This affected versions has been limited. Please create a free account to view the full affected versions.]

Fixed versions

[This fixed versions has been limited. Please create a free account to view the full fixed versions.]

Vulnerability changelog

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.


CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
MISC:https://review.opendev.org/#/c/631240/: https://review.opendev.org/#/c/631240/

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10138
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
• https://review.opendev.org/#/c/631240/