Apache Ozone

3 results · Clear filters · Feed

• High 8.1
  CVE-2024-45106

  Apache Ozone: Improper authentication when generating S3 secrets

  Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The…

  Apache Software Foundation Apache Ozone org.apache.ozone:ozone Maven
  Dec 3, 2024
• High 8.8
  CVE-2021-39236

  Owners of the S3 tokens are not validated

  In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

  Apache Software Foundation Apache Ozone org.apache.hadoop:hadoop-ozone-ozone-manager Maven
  Nov 19, 2021
• High 8.8
  CVE-2021-39232

  Missing admin check for SCM related admin commands

  In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.

  Apache Software Foundation Apache Ozone org.apache.ozone:ozone-main Maven
  Nov 19, 2021