Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.ozone:ozone-main

8 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 1 medium
Registry
Maven Central

Advisories 8

  • CVE-2023-39196Medium 5.3

    Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints

    Affected: from 1.2.0, fixed in 1.4.0.

  • Unauthenticated access to Ozone Recon HTTP endpoints

    Affected: fixed in 1.2.0.

  • Access mode of block tokens are not enforced

    Affected: fixed in 1.2.0.

  • Raw block data can be read bypassing ACL/authorization

    Affected: fixed in 1.2.0.

  • Container-related datanode operations can be called without authorization

    Affected: fixed in 1.2.0.

  • Missing admin check for SCM related admin commands

    Affected: fixed in 1.2.0.

  • Missing authentication/authorization on internal RPC endpoints

    Affected: fixed in 1.2.0.

  • Original block tokens are persisted and can be retrieved

    Affected: fixed in 1.2.0.