CVE-2019-10138 : Security Advisory and Response

A vulnerability in the python-novajoin plugin for Red Hat OpenStack Platform, versions up to 1.1.1 excluded, allows unauthorized generation of FreeIPA tokens.

Understanding CVE-2019-10138

This CVE involves a security flaw in the python-novajoin plugin for Red Hat OpenStack Platform.

What is CVE-2019-10138?

The vulnerability in python-novajoin plugin allows any authenticated user through keystone to create FreeIPA tokens due to inadequate access control.

The Impact of CVE-2019-10138

The vulnerability has a CVSS base score of 7.1 (High severity) with significant impacts on confidentiality, integrity, and availability of affected systems.

Technical Details of CVE-2019-10138

This section provides more technical insights into the CVE.

Vulnerability Description

The novajoin API lacks proper access control, enabling any keystone authenticated user to generate FreeIPA tokens.

Affected Systems and Versions

Product: python-novajoin
Vendor: Red Hat
Affected Versions: All versions up to, excluding 1.1.1

Exploitation Mechanism

The vulnerability can be exploited by any authenticated user through keystone to create FreeIPA tokens, potentially leading to unauthorized access.

Mitigation and Prevention

Protect your systems from CVE-2019-10138 with the following steps:

Immediate Steps to Take

Update to a patched version that addresses the access control issue.
Monitor and restrict access to the novajoin API to authorized users only.

Long-Term Security Practices

Regularly review and enhance access control mechanisms in your environment.
Conduct security training for users to prevent unauthorized token generation.

Patching and Updates

Apply the security patch provided by Red Hat to fix the access control vulnerability.