CVE-2020-17517 Ozone S3 Gateway allows bucket and key access to non authenticated users

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...

CVE-2020-17517

The CVE-2020-17517 entry affects Apache Ozone prior to 1.1.0, where the S3 gateway/cluster allowed anonymous access to buckets and keys via curl or unauthenticated HTTP requests. This is a authorization/config issue that enables data exposure to unauthenticated users. The practical impact is data...

PT-2021-10095 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone versions prior to 1.1.0 Description: The issue allows unauthorized access to buckets and keys in a secure Apache Ozone Cluster through a curl command or an unauthenticated HTTP request, exposing data to anonymous clients or users...

Apache Ozone 访问控制错误漏洞

Apache Ozone is a scalable, redundant and distributed object store for Hadoop and cloud-native environments. An authorization issue vulnerability exists in Apache Ozone Cluster versions prior to 1.1.0 related to the affected version allowing access to keys and buckets via curl commands or...