PT-2021-22483 · Apache · Apache Ozone

Marton Elek · Published 2021-11-19 · Updated 2022-07-12 · CVE-2021-39233

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Ozone versions prior to 1.2.0

Description The issue arises from the lack of proper authorization for Container related Datanode requests in Apache Ozone, allowing any client to make these requests.

Recommendations For Apache Ozone versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue.

Fix

Incorrect Authorization

Missing Authentication

Weakness Enumeration

CWE-863

CWE-306

Related Identifiers

CVE-2021-39233

GHSA-33XH-XCH9-P6HJ

Affected Products

Apache Ozone

References · 7

• https://osv.dev/vulnerability/GHSA-33xh-xch9-p6hj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39233 · Security Note
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39233 · Vendor Advisory
• https://t.me/cvenotify/23462 · Telegram Post
• http://openwall.com/lists/oss-security/2021/11/19/4 · Note
• https://t.me/cibsecurity/32675 · Telegram Post