CVE-2019-10138

Advisory

Novajoin 1.1.1 includes a fix for CVE-2019-10138: A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.


CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
MISC:https://review.opendev.org/#/c/631240/: https://review.opendev.org/#/c/631240/

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10138
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
• https://review.opendev.org/#/c/631240/