Apache Software Foundation Apache Ozone vulnerabilities

11 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Latest Apache Software Foundation Apache Ozone vulnerabilities

CVE-2024-45106 — Apache Ozone: Improper authentication when generating S3 secrets (CVSS 8.1)
CVE-2023-39196 — Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints (CVSS 5.3)
CVE-2021-41532 — Unauthenticated access to Ozone Recon HTTP endpoints (CVSS 5.3)
CVE-2021-39236 — Owners of the S3 tokens are not validated (CVSS 8.8)
CVE-2021-39235 — Access mode of block tokens are not enforced (CVSS 6.5)
CVE-2021-39234 — Raw block data can be read bypassing ACL/authorization (CVSS 6.8)
CVE-2021-39233 — Container-related datanode operations can be called without authorization (CVSS 9.1)
CVE-2021-39232 — Missing admin check for SCM related admin commands (CVSS 8.8)
CVE-2021-39231 — Missing authentication/authorization on internal RPC endpoints (CVSS 9.1)
CVE-2021-36372 — Original block tokens are persisted and can be retrieved (CVSS 9.8)
CVE-2020-17517 — Ozone S3 Gateway allows bucket and key access to non authenticated users (CVSS 7.5)