CVE-2019-10138
High
Description
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Python Novajoin
PublishedJul 30, 2019
First seenJul 30, 2019
Weakness typeCWE-284Improper access control
How to fix
Update
- python novajoin1.1.1 or later
- novajoin1.1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python novajoin | v < 1.1.1 | 1.1.1 |
| novajoinPyPI | v < 1.1.1 | 1.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.