CVE-2021-39235

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@apache.org

Published

2021-11-19

Last modified

2024-08-04

Weaknesses

CWE-732

Affected products

• Ozone (Apache)
• Apache Ozone (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2021/11/19/6
• https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E