CVE-2019-10138
Improper Access Control in novajoin
7.1 HighFix available
CVE-2019-10138 is a high vulnerability (CVSS 7.1) in Python Novajoin, published July 30, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in novajoin 1.1.1.
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.03%Up 0.4 points since Apr 14, 2021
What each source reports
CVE List Score used
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
CVE-2019-10138- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2019-0097
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
EUVD-2019-0097- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xf8c-3cgx-fcwm
Improper Access Control in novajoin
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
GHSA-xf8c-3cgx-fcwm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
CVE-2019-10138- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-xf8c-3cgx-fcwm
Improper Access Control in novajoin
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
GHSA-xf8c-3cgx-fcwm- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVRHBA-2019:0944
Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 14 bug fix and enhancement advisory
- Record
RHBA-2019:0944- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2019:1728
Red Hat Security Advisory: python-novajoin security and bug fix update
- Record
RHSA-2019:1728- CVSS 3.0
- 7.1 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2019-192 No score
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
- Record
PYSEC-2019-192- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
novajoinPyPI |
through 1.1.0 | 1.1.1 |
novajoinPyPI |
before 1.1.1, plus listed versions 1.0.101.0.111.0.121.0.131.0.14 Show 10 moreShow less1.0.151.0.161.0.171.0.181.0.191.0.201.0.211.0.221.0.91.1.0 |
1.1.1 |
python-octaviaclientRed Hat:openstack:14::el7 |
before 0:1.6.0-0.20180816134808.64d007f.el7ost | 0:1.6.0-0.20180816134808.64d007f.el7ost |
python2-octaviaclientRed Hat:openstack:14::el7 |
before 0:1.6.0-0.20180816134808.64d007f.el7ost | 0:1.6.0-0.20180816134808.64d007f.el7ost |
ansible-role-container-registryRed Hat:openstack:14::el7 |
before 0:1.0.1-0.20190218212245.d6a749a.el7ost | 0:1.0.1-0.20190218212245.d6a749a.el7ost |
ansible-role-redhat-subscriptionRed Hat:openstack:14::el7 |
before 0:1.0.2-1.el7ost | 0:1.0.2-1.el7ost |
ansible-role-tripleo-modify-imageRed Hat:openstack:14::el7 |
before 0:1.0.1-0.20190226052419.9014df9.el7ost | 0:1.0.1-0.20190226052419.9014df9.el7ost |
ansible-tripleo-ipsecRed Hat:openstack:14::el7 |
before 0:9.1.0-1.el7ost | 0:9.1.0-1.el7ost |
openstack-barbicanRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
openstack-barbican-apiRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
Show 78 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-barbican-commonRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
openstack-barbican-keystone-listenerRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
openstack-barbican-workerRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
openstack-designateRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-agentRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-apiRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-centralRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-commonRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-mdnsRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-pool-managerRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-producerRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-sinkRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-workerRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-designate-zone-managerRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
openstack-heat-uiRed Hat:openstack:14::el7 |
before 0:1.4.1-0.20190130023741.0b301df.el7ost | 0:1.4.1-0.20190130023741.0b301df.el7ost |
openstack-kuryr-kubernetesRed Hat:openstack:14::el7 |
before 0:0.5.4-0.20190220170509.17d2635.el7ost | 0:0.5.4-0.20190220170509.17d2635.el7ost |
openstack-kuryr-kubernetes-cniRed Hat:openstack:14::el7 |
before 0:0.5.4-0.20190220170509.17d2635.el7ost | 0:0.5.4-0.20190220170509.17d2635.el7ost |
openstack-kuryr-kubernetes-commonRed Hat:openstack:14::el7 |
before 0:0.5.4-0.20190220170509.17d2635.el7ost | 0:0.5.4-0.20190220170509.17d2635.el7ost |
openstack-kuryr-kubernetes-controllerRed Hat:openstack:14::el7 |
before 0:0.5.4-0.20190220170509.17d2635.el7ost | 0:0.5.4-0.20190220170509.17d2635.el7ost |
openstack-manilaRed Hat:openstack:14::el7 |
before 1:7.1.0-2.el7ost | 1:7.1.0-2.el7ost |
openstack-manila-shareRed Hat:openstack:14::el7 |
before 1:7.1.0-2.el7ost | 1:7.1.0-2.el7ost |
openstack-manila-uiRed Hat:openstack:14::el7 |
before 0:2.16.1-0.20190204170113.4865df2.el7ost | 0:2.16.1-0.20190204170113.4865df2.el7ost |
openstack-octavia-uiRed Hat:openstack:14::el7 |
before 0:2.0.1-0.20190110112807.85e4a3e.el7ost | 0:2.0.1-0.20190110112807.85e4a3e.el7ost |
openstack-selinuxRed Hat:openstack:14::el7 |
before 0:0.8.18-1.el7ost | 0:0.8.18-1.el7ost |
openstack-tempestRed Hat:openstack:14::el7 |
before 1:19.0.0-3.el7ost | 1:19.0.0-3.el7ost |
openstack-tempest-allRed Hat:openstack:14::el7 |
before 1:19.0.0-3.el7ost | 1:19.0.0-3.el7ost |
openstack-zaqarRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20181026065336.fed6d77.el7ost | 1:7.0.1-0.20181026065336.fed6d77.el7ost |
openvswitch2.10Red Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-debuginfoRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-develRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-ovn-centralRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-ovn-commonRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-ovn-hostRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
openvswitch2.10-ovn-vtepRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
python-barbicanRed Hat:openstack:14::el7 |
before 0:7.0.1-0.20190204192112.ed17b57.el7ost | 0:7.0.1-0.20190204192112.ed17b57.el7ost |
python-designateRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
python-designate-testsRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20190314164436.7f4c878.el7ost | 1:7.0.1-0.20190314164436.7f4c878.el7ost |
python-glance-storeRed Hat:openstack:14::el7 |
before 0:0.26.2-0.20181026221750.d001c3c.el7ost | 0:0.26.2-0.20181026221750.d001c3c.el7ost |
python-hardwareRed Hat:openstack:14::el7 |
before 0:0.18.1-0.20190301121902.b417976.el7ost | 0:0.18.1-0.20190301121902.b417976.el7ost |
python-hardware-detectRed Hat:openstack:14::el7 |
before 0:0.18.1-0.20190301121902.b417976.el7ost | 0:0.18.1-0.20190301121902.b417976.el7ost |
python-heat-ui-docRed Hat:openstack:14::el7 |
before 0:1.4.1-0.20190130023741.0b301df.el7ost | 0:1.4.1-0.20190130023741.0b301df.el7ost |
python-manilaRed Hat:openstack:14::el7 |
before 1:7.1.0-2.el7ost | 1:7.1.0-2.el7ost |
python-manila-testsRed Hat:openstack:14::el7 |
before 1:7.1.0-2.el7ost | 1:7.1.0-2.el7ost |
python-novajoinRed Hat:openstack:14::el7 |
before 0:1.1.1-2.el7ost | 0:1.1.1-2.el7ost |
python-openvswitch2.10Red Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
python-os-faultsRed Hat:openstack:14::el7 |
before 0:0.2.1-1.el7ost | 0:0.2.1-1.el7ost |
python-oslo-cacheRed Hat:openstack:14::el7 |
before 0:1.30.3-0.20190204170706.5f42092.el7ost | 0:1.30.3-0.20190204170706.5f42092.el7ost |
python-oslo-cache-langRed Hat:openstack:14::el7 |
before 0:1.30.3-0.20190204170706.5f42092.el7ost | 0:1.30.3-0.20190204170706.5f42092.el7ost |
python-ovsdbappRed Hat:openstack:14::el7 |
before 0:0.12.3-1.el7ost | 0:0.12.3-1.el7ost |
python-qpid-protonRed Hat:openstack:14::el7 |
before 0:0.26.0-3.el7 | 0:0.26.0-3.el7 |
python-telemetry-tests-tempestRed Hat:openstack:14::el7 |
before 0:0.2.0-0.20190222195250.7f0e315.el7ost | 0:0.2.0-0.20190222195250.7f0e315.el7ost |
python-vmware-nsxlibRed Hat:openstack:14::el7 |
before 0:13.0.1-0.20190220070404.24a7ff4.el7ost | 0:13.0.1-0.20190220070404.24a7ff4.el7ost |
python-wsmeRed Hat:openstack:14::el7 |
before 0:0.9.4-0.20190314161310.1d73d6e.el7ost | 0:0.9.4-0.20190314161310.1d73d6e.el7ost |
python-zaqar-testsRed Hat:openstack:14::el7 |
before 1:7.0.1-0.20181026065336.fed6d77.el7ost | 1:7.0.1-0.20181026065336.fed6d77.el7ost |
python2-glance-storeRed Hat:openstack:14::el7 |
before 0:0.26.2-0.20181026221750.d001c3c.el7ost | 0:0.26.2-0.20181026221750.d001c3c.el7ost |
python2-kuryr-kubernetesRed Hat:openstack:14::el7 |
before 0:0.5.4-0.20190220170509.17d2635.el7ost | 0:0.5.4-0.20190220170509.17d2635.el7ost |
python2-os-faultsRed Hat:openstack:14::el7 |
before 0:0.2.1-1.el7ost | 0:0.2.1-1.el7ost |
python2-os-faults-libvirtRed Hat:openstack:14::el7 |
before 0:0.2.1-1.el7ost | 0:0.2.1-1.el7ost |
python2-oslo-cacheRed Hat:openstack:14::el7 |
before 0:1.30.3-0.20190204170706.5f42092.el7ost | 0:1.30.3-0.20190204170706.5f42092.el7ost |
python2-ovsdbappRed Hat:openstack:14::el7 |
before 0:0.12.3-1.el7ost | 0:0.12.3-1.el7ost |
python2-telemetry-tests-tempestRed Hat:openstack:14::el7 |
before 0:0.2.0-0.20190222195250.7f0e315.el7ost | 0:0.2.0-0.20190222195250.7f0e315.el7ost |
python2-tempestRed Hat:openstack:14::el7 |
before 1:19.0.0-3.el7ost | 1:19.0.0-3.el7ost |
python2-tempest-testsRed Hat:openstack:14::el7 |
before 1:19.0.0-3.el7ost | 1:19.0.0-3.el7ost |
python2-vmware-nsxlibRed Hat:openstack:14::el7 |
before 0:13.0.1-0.20190220070404.24a7ff4.el7ost | 0:13.0.1-0.20190220070404.24a7ff4.el7ost |
python2-vmware-nsxlib-testsRed Hat:openstack:14::el7 |
before 0:13.0.1-0.20190220070404.24a7ff4.el7ost | 0:13.0.1-0.20190220070404.24a7ff4.el7ost |
python2-wsmeRed Hat:openstack:14::el7 |
before 0:0.9.4-0.20190314161310.1d73d6e.el7ost | 0:0.9.4-0.20190314161310.1d73d6e.el7ost |
qpid-protonRed Hat:openstack:14::el7 |
before 0:0.26.0-3.el7 | 0:0.26.0-3.el7 |
qpid-proton-cRed Hat:openstack:14::el7 |
before 0:0.26.0-3.el7 | 0:0.26.0-3.el7 |
qpid-proton-debuginfoRed Hat:openstack:14::el7 |
before 0:0.26.0-3.el7 | 0:0.26.0-3.el7 |
rhosp-releaseRed Hat:openstack:14::el7 |
before 0:14.0.2-1.el7ost | 0:14.0.2-1.el7ost |
skydiveRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
skydive-agentRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
skydive-analyzerRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
skydive-ansibleRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
skydive-debuginfoRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
skydive-selinuxRed Hat:openstack:14::el7 |
before 0:0.20.3-1.el7ost | 0:0.20.3-1.el7ost |
openvswitch2.10-testRed Hat:openstack:14::el7 |
before 0:2.10.0-28.el7fdp.2 | 0:2.10.0-28.el7fdp.2 |
python-novajoinRed Hat:openstack:13::el7 |
before 0:1.1.1-3.el7ost | 0:1.1.1-3.el7ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10138
review.opendev.org
nvd.nist.gov/vuln/detail/CVE-2019-10138
github.com/pypa/advisory-database/tree/main/vulns/novajoin/PYSEC-2019-192.yaml
Show 43 moreShow less
access.redhat.com/errata/RHBA-2019:0944
security.access.redhat.com/data/csaf/v2/advisories/2019/rhba-2019_0944.json
cve.org/CVERecord?id=CVE-2019-10138