critical9.1
CVE-2021-39233
Incorrect Authorization in Apache Ozone
Impact
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.ozone:ozone-main | < 1.2.0 | 1.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Ozone | before 1.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2021/11/19/4
- https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E
- https://github.com/advisories/GHSA-33xh-xch9-p6hj
- https://nvd.nist.gov/vuln/detail/CVE-2021-39233