Apache Ozone Vulnerabilities

Apache Apache Ozone vulnerabilities.

3 December 2024

Improper Authentication in Apache Ozone 1.4.0 Allows Revoking and Regenerating S3 Secrets
CVE-2024-45106
ApacheApache Ozone

7 February 2024

Improper Authentication Vulnerability in Apache Ozone
CVE-2023-39196
ApacheApache Ozone5.3MEDIUM

19 November 2021

Missing authentication/authorization on internal RPC endpoints
CVE-2021-39231
ApacheApache Ozone9.1CRITICAL
Unauthenticated access to Ozone Recon HTTP endpoints
CVE-2021-41532
ApacheApache Ozone5.3MEDIUM
Owners of the S3 tokens are not validated
CVE-2021-39236
ApacheApache Ozone8.8HIGH
Access mode of block tokens are not enforced
CVE-2021-39235
ApacheApache Ozone6.5MEDIUM
Raw block data can be read bypassing ACL/authorization
CVE-2021-39234
ApacheApache Ozone6.8MEDIUM
Container-related datanode operations can be called without authorization
CVE-2021-39233
ApacheApache Ozone9.1CRITICAL
Missing admin check for SCM related admin commands
CVE-2021-39232
ApacheApache Ozone8.8HIGH
Original block tokens are persisted and can be retrieved
CVE-2021-36372
ApacheApache Ozone9.8CRITICAL

27 April 2021

Ozone S3 Gateway allows bucket and key access to non authenticated users
CVE-2020-17517
ApacheApache Ozone7.5HIGH

No more vulnerabilities to load.