Description
A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | python-novajoin | all up to, excluding 1.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 14 | ansible-role-container-registry | 1.0.1-0.20190218212245.d6a749a.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | ansible-role-redhat-subscription | 1.0.2-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | ansible-role-tripleo-modify-image | 1.0.1-0.20190226052419.9014df9.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | ansible-tripleo-ipsec | 9.1.0-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openstack-heat-ui +1 | 1.4.1-0.20190130023741.0b301df.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openstack-manila-ui | 2.16.1-0.20190204170113.4865df2.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openstack-octavia-ui | 2.0.1-0.20190110112807.85e4a3e.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openstack-selinux | 0.8.18-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openstack-zaqar +1 | 1:7.0.1-0.20181026065336.fed6d77.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | openvswitch2.10 +7 | 2.10.0-28.el7fdp.2 | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-barbican +5 | 7.0.1-0.20190204192112.ed17b57.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-designate +12 | 1:7.0.1-0.20190314164436.7f4c878.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-glance-store +1 | 0.26.2-0.20181026221750.d001c3c.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-hardware +1 | 0.18.1-0.20190301121902.b417976.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-manila +3 | 1:7.1.0-2.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-novajoin | 1.1.1-2.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-octaviaclient +1 | 1.6.0-0.20180816134808.64d007f.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-os-faults +2 | 0.2.1-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-oslo-cache +2 | 1.30.3-0.20190204170706.5f42092.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-ovsdbapp +1 | 0.12.3-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-telemetry-tests-tempest +1 | 0.2.0-0.20190222195250.7f0e315.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-vmware-nsxlib +2 | 13.0.1-0.20190220070404.24a7ff4.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python-wsme +1 | 0.9.4-0.20190314161310.1d73d6e.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python2-kuryr-kubernetes +4 | 0.5.4-0.20190220170509.17d2635.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | python2-tempest +3 | 1:19.0.0-3.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | qpid-proton +2 | 0.26.0-3.el7 | RHBA-2019:0944 |
| Red Hat OpenStack 14 | rhosp-release | 14.0.2-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 14 | skydive +4 | 0.20.3-1.el7ost | RHBA-2019:0944 |
| Red Hat OpenStack 13 | python-novajoin | 1.1.1-3.el7ost | RHSA-2019:1728 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | novajoin | < 1.1.1 | 1.1.1 | GHSA-xf8c-3cgx-fcwm |
Advisories 2
- RHSA-2019:1728 Red Hat Security Advisory: python-novajoin security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHBA-2019:0944 Red Hat Bug Fix Advisory: Red Hat OpenStack Platform 14 bug fix and enhancement advisory Red Hat Security Advisories (RHSA) · Aug 8, 2026