GHSA-86fh-j58m-7pf5

ghsaUSosv

Improper Privilege Management in Apache Ozone

view advisory published 2021-11-23Licence: CC-BY-4.0

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-36372US	critical9.8	2.53% (85th)	—	2021-11-19
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to th…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/11/19/1WEB
https://github.com/apache/ozonePACKAGE
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-36372ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan