CVE-2021-39231

CVE-2021-39231 affects Apache Ozone

CVE-2021-39231 Missing authentication/authorization on internal RPC endpoints

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration...

CVE-2021-36372 Original block tokens are persisted and can be retrieved

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked...

Apache Ozone 输入验证错误漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an input validation error vulnerability exists in Apache Ozone, which stems from the product's Ozone Datanode not checking the block token's access mode parameter. An...

PT-2021-22485 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue arises because the Ozone Datanode in Apache Ozone does not check the access mode parameter of the block token. As a result, authenticated users who have a valid READ block token can...

Apache Ozone 安全漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.2.0 has a security vulnerability that allows an attacker to retrieve token data from the database and use it...

Apache Ozone 安全漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. Apache Ozone version 1.2.0 has a security vulnerability that stems from various internal server-to-server RPC endpoints that can be used to connect, and an attacker can...

Apache Ozone 访问控制错误漏洞

Apache Ozone is an application. An accessible control error vulnerability exists in Apache Ozone, which stems from the product's failure to add valid permission checks for users. An attacker could bypass ACL checks to access sensitive information through this vulnerability...

Apache Ozone 授权问题漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an authorization issue vulnerability exists in Apache Ozone, which stems from the product's failure to protect OM requests with valid privileges. An attacker could create a...

Apache Ozone 访问控制错误漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments, an access control error vulnerability exists in Apache Ozone that stems from the product not adding valid permissions for access to OM, SCM and Datanode metadata. An attack...

PT-2021-23321 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue allows any unauthenticated user to access metadata from Recon HTTP endpoints, which provide access to OM, SCM, and Datanode metadata, due to a bug. Recommendations: For versions prio...

Apache Ozone 安全漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. a security vulnerability in Apache Ozone version 1.2.0, which stems from the fact that certain administrator-related SCM commands can be executed by any authenticated user...

Apache Ozone 安全漏洞

Apache Ozone is an application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. a security vulnerability in Apache Ozone version 1.2.0, which stems from the fact that certain administrator-related SCM commands can be executed by any authenticated user...

PT-2021-22482 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue allows certain admin-related SCM commands to be executed by any authenticated users, not just by admins. Recommendations: For versions prior to 1.2.0, update to version 1.2.0 or late...

PT-2021-21257 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.2.0 Description: The issue allows authenticated users with permission to the key to retrieve initially generated block tokens from the metadata database. These tokens can be used even after access has been...

Privilege Escalation

hadoop-ozone-client is vulnerable to privilege escalation. An attacker can use a curl command or an unauthenticated HTTP request to access S3 buckets and keys in a secure Apache Ozone Cluster, thereby allowing unauthorized access to buckets and keys resulting in exposure of data to anonymous...

Apache Ozone Authorization Problem Vulnerability

Apache Ozone is a scalable, redundant and distributed object store for Hadoop and cloud-native environments. An authorization issue vulnerability exists in Apache Ozone Cluster versions prior to 1.1.0 related to the affected version allowing access to keys and buckets via curl commands or...

CVE-2020-17517

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...

CVE-2020-17517

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...

Design/Logic Flaw

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...