GHSA-xf8c-3cgx-fcwm

Improper Access Control in novajoin

At a glance

Published: 2020-03-12 16:54 UTC
Updated: 2024-09-26 15:06 UTC
CVE: CVE-2019-10138
Aliases: PYSEC-2019-192
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Affected packages

Package	Versions
PyPI · novajoin	introduced 0, fixed 1.1.1

References

https://nvd.nist.gov/vuln/detail/CVE-2019-10138 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138 WEB
https://github.com/openstack-archive/novajoin PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/novajoin/PYSEC-2019-192.yaml WEB
https://review.opendev.org/#/c/631240 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database