org.apache.ozone:ozone-main vulnerabilities (Maven)

8 vulnerabilities.

• org.apache.ozone:ozone-main Maven Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints CVE-2023-39196 Fix available 5.3 MediumFebruary 7, 2024
• org.apache.ozone:ozone-main Maven Unauthenticated access to Ozone Recon HTTP endpoints CVE-2021-41532 Fix available 5.3 MediumNovember 19, 2021
• org.apache.ozone:ozone-main Maven Access mode of block tokens are not enforced CVE-2021-39235 Fix available 6.5 MediumNovember 19, 2021
• org.apache.ozone:ozone-main Maven Raw block data can be read bypassing ACL/authorization CVE-2021-39234 Fix available 6.8 MediumNovember 19, 2021
• org.apache.ozone:ozone-main Maven Container-related datanode operations can be called without authorization CVE-2021-39233 Fix available 9.1 CriticalNovember 19, 2021
• org.apache.ozone:ozone-main Maven Missing admin check for SCM related admin commands CVE-2021-39232 Fix available 8.8 HighNovember 19, 2021
• org.apache.ozone:ozone-main Maven Missing authentication/authorization on internal RPC endpoints CVE-2021-39231 Fix available 9.1 CriticalNovember 19, 2021
• org.apache.ozone:ozone-main Maven Original block tokens are persisted and can be retrieved CVE-2021-36372 Fix available 9.8 CriticalNovember 19, 2021