# org.apache.ozone:ozone-main (Maven) vulnerabilities

8 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/org.apache.ozone/ozone-main

## Advisories (8)

### [CVE-2023-39196](https://cve.now/CVE-2023-39196): Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints

- Severity: Medium 5.3
- Published: Feb 7, 2024
- Affected: from 1.2.0, fixed in 1.4.0.

### [CVE-2021-41532](https://cve.now/CVE-2021-41532): Unauthenticated access to Ozone Recon HTTP endpoints

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-39235](https://cve.now/CVE-2021-39235): Access mode of block tokens are not enforced

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-39234](https://cve.now/CVE-2021-39234): Raw block data can be read bypassing ACL/authorization

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-39233](https://cve.now/CVE-2021-39233): Container-related datanode operations can be called without authorization

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-39232](https://cve.now/CVE-2021-39232): Missing admin check for SCM related admin commands

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-39231](https://cve.now/CVE-2021-39231): Missing authentication/authorization on internal RPC endpoints

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

### [CVE-2021-36372](https://cve.now/CVE-2021-36372): Original block tokens are persisted and can be retrieved

- Severity: Unrated
- Published: Nov 19, 2021
- Affected: fixed in 1.2.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.apache.ozone:ozone-main
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.