Incorrect permissions in Apache Ozone

MEDIUM 6.5CVE-2021-39235 · GHSA-c6j7-4fr9-c76p · Published 19/11/2021 · updated 17/06/2026

In short

CVE-2021-39235 is a MEDIUM (CVSS 6.5) vulnerability affecting org.apache.ozone:ozone-main, ozone (apache).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.2% of all vulnerabilities.
Fix: update to 1.2.0 or later.

Package	Affected versions	Patched versions
org.apache.ozone:ozone-main Maven	`< 1.2.0`	`1.2.0`
ozone apache	`< 1.2.0`	`1.2.0`

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

NVD description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

References

nvd.nist.gov/vuln/detail/CVE-2021-39235 · ADVISORY
apache/ozone · PACKAGE
mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E · WEB
openwall.com/lists/oss-security/2021/11/19/6 · WEB

More vulnerabilities in org.apache.ozone:ozone-main

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.ozone:ozone-main

Maven

< 1.2.0

1.2.0

ozone

apache

< 1.2.0

1.2.0

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

NVD description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

More vulnerabilities in org.apache.ozone:ozone-main

See all →