Apache Ozone
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_ozone:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Ozone (905b2d40-f802-5b05-8af9-9049e8c84401) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-45106 |
vulnerable | 2026-06-08 06:45:54.755800 |
Apache Ozone: Improper authentication when generating S3 secrets
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if:
* ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false.
* The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators.
Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.
Published: 2024-12-03T09:06:23.356Z
Updated: 2024-12-03T15:52:28.971Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-39196 |
vulnerable | 2026-06-08 06:09:35.916966 |
Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints
MEDIUM (5.3)
Improper Authentication vulnerability in Apache Ozone.
The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication.
The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability.
The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone.
This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Published: 2024-02-07T12:56:29.534Z
Updated: 2025-02-13T17:02:38.948Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-41532 |
vulnerable | 2026-06-08 05:35:20.636938 |
Unauthenticated access to Ozone Recon HTTP endpoints
In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Published: 2021-11-19T09:20:26.000Z
Updated: 2024-08-04T03:15:29.160Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39236 |
vulnerable | 2026-06-08 05:33:49.240395 |
Owners of the S3 tokens are not validated
In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Published: 2021-11-19T09:20:25.000Z
Updated: 2024-08-04T02:06:40.807Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39235 |
vulnerable | 2026-06-08 05:33:49.239945 |
Access mode of block tokens are not enforced
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Published: 2021-11-19T09:20:23.000Z
Updated: 2024-08-04T02:06:41.327Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39234 |
vulnerable | 2026-06-08 05:33:49.239615 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39233 |
vulnerable | 2026-06-08 05:33:49.239141 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39232 |
vulnerable | 2026-06-08 05:33:49.238771 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-39231 |
vulnerable | 2026-06-08 05:33:49.237791 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36372 |
vulnerable | 2026-06-08 05:32:52.098561 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-17517 |
vulnerable | 2026-06-08 05:20:56.639253 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.