PT-2021-22485 · Apache · Apache Ozone

Marton Elek · Published 2021-11-19 · Updated 2023-12-22 · CVE-2021-39235

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache Ozone versions prior to 1.2.0

Description The issue arises because the Ozone Datanode in Apache Ozone does not check the access mode parameter of the block token. As a result, authenticated users who have a valid READ block token can perform any write operation on the same block.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the block token to prevent unauthorized write operations.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2021-39235

GHSA-C6J7-4FR9-C76P

Affected Products

Apache Ozone

References · 9

• https://osv.dev/vulnerability/GHSA-c6j7-4fr9-c76p · Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39235 · Security Note
• https://github.com/apache/ozone · Note
• http://openwall.com/lists/oss-security/2021/11/19/6 · Note
• https://t.me/cvenotify/64954 · Telegram Post
• https://t.me/cvenotify/23460 · Telegram Post
• https://t.me/cibsecurity/32680 · Telegram Post