PT-2024-31436 · Apache · Apache Ozone

Ethan Rose + 1 · Published 2024-12-02 · Updated 2025-07-01 · CVE-2024-45106

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Ozone version 1.4.0

Description The issue is related to improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone. This allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user, but only if specific conditions are met: ozone.s3g.secret.http.enabled is set to true and the user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators.

Recommendations Upgrade to Apache Ozone version 1.4.1, which disables the affected endpoint. As a temporary workaround, consider setting ozone.s3g.secret.http.enabled to false to prevent exploitation. Restrict access to the S3 Gateway to minimize the risk of unauthorized S3 secret regeneration.

Fix

Incorrect Authorization

Improper Authentication

Weakness Enumeration

CWE-863

CWE-287

Related Identifiers

CVE-2024-45106

GHSA-RCQ8-9Q3J-98MW

Affected Products

Apache Ozone

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-45106 · Security Note
• https://osv.dev/vulnerability/GHSA-rcq8-9q3j-98mw · Vendor Advisory
• https://lists.apache.org/thread/rylnxwttp004kvotpk9j158vb238pfkm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45106 · Vendor Advisory
• https://github.com/apache/ozone/pull/5233 · Note
• https://github.com/apache/ozone · Note
• https://t.me/cvenotify/102883 · Telegram Post
• https://twitter.com/oss_security/status/1863630855651922415 · Twitter Post
• https://t.me/cvenotify/127318 · Telegram Post
• https://twitter.com/CVEnew/status/1863879437466673229 · Twitter Post
• https://twitter.com/cracbot/status/1865637487026311348 · Twitter Post
• http://openwall.com/lists/oss-security/2024/12/02/1 · Note
• https://t.me/cvedetector/11878 · Telegram Post