GHSA-xf8c-3cgx-fcwm

Improper Access Control in novajoin

En bref

Publiée: 2020-03-12 16:54 UTC
Mise à jour: 2024-09-26 15:06 UTC
CVE: CVE-2019-10138
Alias: PYSEC-2019-192
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Paquets affectés

Paquet	Versions
PyPI · novajoin	introduced 0, fixed 1.1.1

Références

https://nvd.nist.gov/vuln/detail/CVE-2019-10138 ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138 WEB
https://github.com/openstack-archive/novajoin PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/novajoin/PYSEC-2019-192.yaml WEB
https://review.opendev.org/#/c/631240 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database