GHSA-33xh-xch9-p6hj

ghsaUSosv

Incorrect Authorization in Apache Ozone

view advisory published 2021-11-23Licence: CC-BY-4.0

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-39233US	critical9.1OT elevated	2.37% (84th)	—	2021-11-19
In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2021/11/19/4WEB
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3EWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-39233ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan