Skip to content
OpenAdvisories
High · 8.8 CVE-2021-39236 EUVD-2021-2299GHSA-5993-wwpg-m92c

Owners of the S3 tokens are not validated

Published Nov 19, 2021 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Ozone Package: org.apache.hadoop:hadoop-ozone-ozone-manager Ecosystem: Maven

Description

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Ozone 1.0 – ≤ 1.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.hadoop:hadoop-ozone-ozone-manager < 1.2.0 1.2.0 GHSA-5993-wwpg-m92c

References