Incorrect permissions in Apache Ozone

MEDIO 6.5CVE-2021-39235 · GHSA-c6j7-4fr9-c76p · Published 19/11/2021 · updated 17/06/2026

In breve

CVE-2021-39235 è una vulnerabilità MEDIO (CVSS 6.5) che riguarda org.apache.ozone:ozone-main, ozone (apache).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 75.2% delle vulnerabilità.
Correzione: aggiornare a 1.2.0 o successiva.

Package	Affected versions	Patched versions
org.apache.ozone:ozone-main Maven	`< 1.2.0`	`1.2.0`
ozone apache	`< 1.2.0`	`1.2.0`

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

NVD description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

References

nvd.nist.gov/vuln/detail/CVE-2021-39235 · ADVISORY
apache/ozone · PACKAGE
mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E · WEB
openwall.com/lists/oss-security/2021/11/19/6 · WEB

Altre vulnerabilità di org.apache.ozone:ozone-main

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.ozone:ozone-main

Maven

< 1.2.0

1.2.0

ozone

apache

< 1.2.0

1.2.0

Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

NVD description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

Altre vulnerabilità di org.apache.ozone:ozone-main

Vedi tutto →