PT-2021-21257 · Apache · Apache Ozone

Marton Elek · Published 2021-11-19 · Updated 2024-01-31 · CVE-2021-36372

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Ozone versions prior to 1.2.0

Description The issue allows authenticated users with permission to the key to retrieve initially generated block tokens from the metadata database. These tokens can be used even after access has been revoked.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-273

Related Identifiers

CVE-2021-36372

GHSA-86FH-J58M-7PF5

Affected Products

Apache Ozone

References · 9

• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36372 · Security Note
• https://osv.dev/vulnerability/GHSA-86fh-j58m-7pf5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36372 · Vendor Advisory
• https://github.com/apache/ozone · Note
• https://t.me/cvenotify/69303 · Telegram Post
• http://openwall.com/lists/oss-security/2021/11/19/1 · Note
• https://t.me/cvenotify/23482 · Telegram Post
• https://t.me/cibsecurity/32678 · Telegram Post