Apache Ozone vulnerabilities

• apache ozone Apache Ozone: Improper authentication when generating S3 secrets CVE-2024-45106 Fix available 8.1 HighDecember 3, 2024
• apache ozone Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints CVE-2023-39196 Fix available 5.3 MediumFebruary 7, 2024
• apache ozone Unauthenticated access to Ozone Recon HTTP endpoints CVE-2021-41532 Fix available 5.3 MediumNovember 19, 2021
• apache ozone Owners of the S3 tokens are not validated CVE-2021-39236 Fix available 8.8 HighNovember 19, 2021
• apache ozone Access mode of block tokens are not enforced CVE-2021-39235 Fix available 6.5 MediumNovember 19, 2021
• apache ozone Raw block data can be read bypassing ACL/authorization CVE-2021-39234 Fix available 6.8 MediumNovember 19, 2021
• apache ozone Container-related datanode operations can be called without authorization CVE-2021-39233 Fix available 9.1 CriticalNovember 19, 2021
• apache ozone Missing admin check for SCM related admin commands CVE-2021-39232 Fix available 8.8 HighNovember 19, 2021
• apache ozone Missing authentication/authorization on internal RPC endpoints CVE-2021-39231 Fix available 9.1 CriticalNovember 19, 2021
• apache ozone Original block tokens are persisted and can be retrieved CVE-2021-36372 Fix available 9.8 CriticalNovember 19, 2021
• apache ozone Ozone S3 Gateway allows bucket and key access to non authenticated users CVE-2020-17517 7.5 HighApril 27, 2021