—

PYSEC-2019-192

Quick fix

PYSEC-2019-192 — novajoin: upgrade to the fixed version with the command below.

pip install --upgrade 'novajoin>=1.1.1'

Details

A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/novajoin

Introduced in: 0Fixed in: 1.1.1

Fixpip install --upgrade 'novajoin>=1.1.1'

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138[REPORT]
https://review.opendev.org/#/c/631240/[WEB]
https://github.com/advisories/GHSA-xf8c-3cgx-fcwm[ADVISORY]