GHSA-3w5h-x4rh-hc28

ghsaUSosv

Exposure of sensitive information in Apache Ozone

view advisory published 2021-11-23Licence: CC-BY-4.0

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-39231US	critical9.1OT elevated	2.37% (84th)	—	2021-11-19
In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/11/19/2WEB
https://github.com/apache/ozonePACKAGE
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-39231ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan