PT-2021-22484 · Apache · Apache Ozone

Marton Elek · Published 2021-11-19 · Updated 2021-11-23 · CVE-2021-39234

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Ozone versions prior to 1.2.0

Description The issue allows authenticated users who know the ID of an existing block to craft specific requests, granting them access to those blocks and bypassing security checks like Access Control Lists (ACL).

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue.

Fix

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

CVE-2021-39234

GHSA-C8CW-2C5J-XFF3

Affected Products

Apache Ozone

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-39234 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39234 · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c8cw-2c5j-xff3 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/11/19/5 · Note
• https://t.me/cibsecurity/32683 · Telegram Post
• https://t.me/cvenotify/23461 · Telegram Post