Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmOGMtM2NneC1mY3dt

Improper Access Control in novajoin

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Permalink: https://github.com/advisories/GHSA-xf8c-3cgx-fcwm
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXhmOGMtM2NneC1mY3dt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 4 years ago
Updated: about 1 year ago

CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-xf8c-3cgx-fcwm, CVE-2019-10138
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-10138
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
• https://review.opendev.org/#/c/631240/
• https://github.com/advisories/GHSA-xf8c-3cgx-fcwm

Blast Radius: 2.6

Affected Packages