GitHub Advisoryadvisory · Maven

GHSA-3w5h-x4rh-hc28 Exposure of sensitive information in Apache Ozone

CRITICAL Published 2021-11-23 Modified 2023-11-15 Official page ↗
Aliases
CVE-2021-39231
Ecosystem
Maven
Packages
org.apache.ozone:ozone-main
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-668, CWE-862
Reviewed
2021-11-22

Affected packages

• Maven org.apache.ozone:ozone-main: < 1.2.0 → fixed in 1.2.0

Description

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

Related

Alias · CVE (1)

  • CVE-2021-39231 In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible… vulnerability

Weakness · CWE (2)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness
  • CWE-862 Missing Authorization weakness

References