CVE-2019-10138

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Score

CVSS 3.1 8.8 High

Status

Modified - secalert@redhat.com

Published

2019-07-30

Last modified

2024-08-04

Weaknesses

CWE-284

Affected products

• Novajoin (Python)
• Python-novajoin (Red Hat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
• https://review.opendev.org/#/c/631240/