CVE-2021-36372: Improper Privilege Management in Apache Ozone
Summary
CVE-2021-36372: Improper Privilege Management in Apache Ozone. Affects org.apache.ozone:ozone-main versions < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Ozone is an open-source object store designed for high-performance, scalable, and reliable storage of large datasets. It provides a distributed file system that allows users to store and retrieve data using a key-value interface. The 'org.apache.ozone:ozone-main' package is a core component of Apache Ozone, responsible for managing block tokens and access permissions. This vulnerability affects versions prior to 1.2.0 of Apache Ozone.
Vulnerability Detail
The vulnerability in Apache Ozone (CVE-2021-36372) is related to improper privilege management. Initially generated block tokens, which are used for access control, are stored in the metadata database. Authenticated users with permission to the key can retrieve these tokens and continue to use them even after their access has been revoked. This can lead to unauthorized access and potential data breaches.
How To Fix
Minimum fixed version
1.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Ozone to address the issue.
Conclusion
The vulnerability in Apache Ozone (CVE-2021-36372) allows authenticated users to continue using initially generated block tokens even after their access has been revoked. To mitigate this risk, it is crucial to upgrade to Apache Ozone version 1.2.0 or later. This upgrade ensures that the tokens are properly invalidated and prevents unauthorized access. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.ozone:ozone-main →
FAQ
Apache Ozone is an open-source object store designed for high-performance, scalable, and reliable storage of large datasets. It provides a distributed file system that allows users to store and retrieve data using a key-value interface.
This vulnerability allows authenticated users with permission to the key to continue using initially generated block tokens even after their access has been revoked. This can lead to unauthorized access and potential data breaches.
To fix this vulnerability, it is recommended to upgrade to Apache Ozone version 1.2.0 or later. This upgrade ensures that initially generated block tokens are properly invalidated and cannot be used by authenticated users after their access is revoked.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Apache Ozone to address the issue.
You can find more information about Apache Ozone on the official Apache Ozone website or the project's GitHub repository.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ozone:ozone-main.
