CVE-2021-39233

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

Score

CVSS 3.1 9.1 Critical

Status

Modified - security@apache.org

Published

2021-11-19

Last modified

2024-08-04

Weaknesses

CWE-306

Affected products

• Ozone (Apache)
• Apache Ozone (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2021/11/19/4
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E