CVE-2019-10138

{"containers": {"cna": {"affected": [{"product": "python-novajoin", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "all up to, excluding 1.1.1"}]}], "descriptions": [{"lang": "en", "value": "A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-07-30T16:16:51.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138"}, {"tags": ["x_refsource_MISC"], "url": "https://review.opendev.org/#/c/631240/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2019-10138", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "python-novajoin", "version": {"version_data": [{"version_value": "all up to, excluding 1.1.1"}]}}]}, "vendor_name": "Red Hat"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens."}]}, "impact": {"cvss": [[{"vectorString": "7.1/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}]]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138"}, {"name": "https://review.opendev.org/#/c/631240/", "refsource": "MISC", "url": "https://review.opendev.org/#/c/631240/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:10:10.017Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://review.opendev.org/#/c/631240/"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2019-10138", "datePublished": "2019-07-30T16:16:51.000Z", "dateReserved": "2019-03-27T00:00:00.000Z", "dateUpdated": "2024-08-04T22:10:10.017Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "python-novajoin", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "all up to, excluding 1.1.1"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python:novajoin:*:*:*:*:*:*:*:*", "matchCriteriaId": "D8939297-2BAD-43BF-BA1A-871D8A407A5C", "versionEndExcluding": "1.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens."}, {"lang": "es", "value": "Se detect\u00f3 un fallo en el plugin python-novajoin, todas las versiones hasta 1.1.1, excluy\u00e9ndola, para Red Hat OpenStack Platform. La API de novajoin carec\u00eda de un control de acceso suficiente, permitiendo a cualquier usuario autenticado pulsaciones de teclas para generar tokens FreeIPA."}], "id": "CVE-2019-10138", "lastModified": "2026-06-17T02:10:20.140", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-07-30T17:15:12.390", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://review.opendev.org/#/c/631240/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://review.opendev.org/#/c/631240/"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by Grzegorz Grasza (Red Hat).", "affected_release": [{"advisory": "RHSA-2019:1728", "cpe": "cpe:/a:redhat:openstack:13::el7", "package": "python-novajoin-0:1.1.1-3.el7ost", "product_name": "Red Hat OpenStack Platform 13.0 (Queens)", "release_date": "2019-07-10T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "ansible-role-container-registry-0:1.0.1-0.20190218212245.d6a749a.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "ansible-role-redhat-subscription-0:1.0.2-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "ansible-role-tripleo-modify-image-0:1.0.1-0.20190226052419.9014df9.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "ansible-tripleo-ipsec-0:9.1.0-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-barbican-0:7.0.1-0.20190204192112.ed17b57.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-designate-1:7.0.1-0.20190314164436.7f4c878.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-heat-ui-0:1.4.1-0.20190130023741.0b301df.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-kuryr-kubernetes-0:0.5.4-0.20190220170509.17d2635.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-manila-1:7.1.0-2.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-manila-ui-0:2.16.1-0.20190204170113.4865df2.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-octavia-ui-0:2.0.1-0.20190110112807.85e4a3e.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-selinux-0:0.8.18-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-tempest-1:19.0.0-3.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openstack-zaqar-1:7.0.1-0.20181026065336.fed6d77.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "openvswitch2.10-0:2.10.0-28.el7fdp.2", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-glance-store-0:0.26.2-0.20181026221750.d001c3c.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-hardware-0:0.18.1-0.20190301121902.b417976.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-novajoin-0:1.1.1-2.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-octaviaclient-0:1.6.0-0.20180816134808.64d007f.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-os-faults-0:0.2.1-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-oslo-cache-0:1.30.3-0.20190204170706.5f42092.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-ovsdbapp-0:0.12.3-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-telemetry-tests-tempest-0:0.2.0-0.20190222195250.7f0e315.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-vmware-nsxlib-0:13.0.1-0.20190220070404.24a7ff4.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "python-wsme-0:0.9.4-0.20190314161310.1d73d6e.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "qpid-proton-0:0.26.0-3.el7", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "rhosp-release-0:14.0.2-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}, {"advisory": "RHBA-2019:0944", "cpe": "cpe:/a:redhat:openstack:14::el7", "package": "skydive-0:0.20.3-1.el7ost", "product_name": "Red Hat OpenStack Platform 14.0 (Rocky)", "release_date": "2019-04-30T00:00:00Z"}], "bugzilla": {"description": "python-novajoin: novajoin API lacks access control", "id": "1670573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1670573"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-284", "details": ["A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.", "A flaw was discovered in the python-novajoin plugin for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens."], "name": "CVE-2019-10138", "package_state": [{"cpe": "cpe:/a:redhat:openstack:15", "fix_state": "Not affected", "package_name": "python-novajoin", "product_name": "Red Hat OpenStack Platform 15 (Stein)"}], "public_date": "2019-01-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-10138\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10138\nhttps://review.opendev.org/#/c/631240/"], "threat_severity": "Moderate"}

{}