CVE-2020-17517

The CVE-2020-17517 entry affects Apache Ozone prior to 1.1.0, where the S3 gateway/cluster allowed anonymous access to buckets and keys via curl or unauthenticated HTTP requests. This is a authorization/config issue that enables data exposure to unauthenticated users. The practical impact is data...

CVE-2020-17517 Ozone S3 Gateway allows bucket and key access to non authenticated users

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...