GCVE - cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Ozone (`02ad599a-e39f-582c-848a-fe08dbeff813`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:apache/ozone`	purl2cpe	2026-06-01 10:14:29.910477
`pkg:github/apache/ozone`	purl2cpe	2026-06-01 10:14:29.910481
`pkg:maven/org.apache.hadoop/hadoop-ozone`	purl2cpe	2026-06-01 10:14:29.910483

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-39196`	vulnerable	2026-06-08 06:09:35.917666	Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints MEDIUM (5.3) Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0. Users are recommended to upgrade to version 1.4.0, which fixes the issue. Published: 2024-02-07T12:56:29.534Z Updated: 2025-02-13T17:02:38.948Z Open on db.gcve.eu Reference links https://lists.apache.org/thread/o96ct5t7kj5cgrmmfc6756m931t08nky http://www.openwall.com/lists/oss-security/2024/02/07/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-41532`	vulnerable	2026-06-08 05:35:20.637776	Unauthenticated access to Ozone Recon HTTP endpoints In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints. Published: 2021-11-19T09:20:26.000Z Updated: 2024-08-04T03:15:29.160Z Open on db.gcve.eu Reference links https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3Ce0bc6598-9669-b897-fc28-de8a896e36aa%40apache.org%3E http://www.openwall.com/lists/oss-security/2021/11/19/8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39236`	vulnerable	2026-06-08 05:33:49.240426	Owners of the S3 tokens are not validated In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user. Published: 2021-11-19T09:20:25.000Z Updated: 2024-08-04T02:06:40.807Z Open on db.gcve.eu Reference links https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C0fd74baa-88a0-39a2-8f3a-b982acb25d5a%40apache.org%3E http://www.openwall.com/lists/oss-security/2021/11/19/7 https://issues.apache.org/jira/browse/HDDS-4763	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39235`	vulnerable	2026-06-08 05:33:49.240076	Access mode of block tokens are not enforced In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block. Published: 2021-11-19T09:20:23.000Z Updated: 2024-08-04T02:06:41.327Z Open on db.gcve.eu Reference links https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E http://www.openwall.com/lists/oss-security/2021/11/19/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39234`	vulnerable	2026-06-08 05:33:49.239645	Raw block data can be read bypassing ACL/authorization In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL. Published: 2021-11-19T09:20:22.000Z Updated: 2024-08-04T01:58:18.340Z Open on db.gcve.eu Reference links https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E http://www.openwall.com/lists/oss-security/2021/11/19/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39233`	vulnerable	2026-06-08 05:33:49.239289	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39232`	vulnerable	2026-06-08 05:33:49.238809	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39231`	vulnerable	2026-06-08 05:33:49.238368	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36372`	vulnerable	2026-06-08 05:32:52.099350	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-17517`	vulnerable	2026-06-08 05:20:56.639935	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.