GitHub Advisoryadvisory · Maven

GHSA-gc37-9g7f-96fx Apache Ozone exposes OM, SCM and Datanode metadata

MEDIUM Published 2021-11-23 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-41532
Ecosystem
Maven
Packages
org.apache.ozone:ozone-main
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-668
Reviewed
2021-11-22

Affected packages

• Maven org.apache.ozone:ozone-main: < 1.2.0 → fixed in 1.2.0

Description

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.

Related

Alias · CVE (1)

  • CVE-2021-41532 In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. vulnerability

Weakness · CWE (1)

  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References