CVE-2021-39235: Incorrect permissions in Apache Ozone

org.apache.ozone:ozone-main Updated 02 Oct 2025

Summary

23/11/2021

Disclosed on

CVE-2021-39235

CVE

Yes i

Fix available

Moderate

Severity

6.5

CVSS Score

CVE-2021-39235: Incorrect permissions in Apache Ozone. Affects org.apache.ozone:ozone-main versions < 1.2.0. Fixed in 1.2.0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Ozone is an open-source distributed object store built on top of Hadoop Distributed File System (HDFS). It provides scalable and reliable storage for big data applications. Ozone Datanode is a component of Apache Ozone responsible for storing and managing data blocks. It uses block tokens for authentication and authorization of read and write operations. However, prior to version 1.2.0, Ozone Datanode does not properly check the access mode parameter of the block token. This vulnerability allows authenticated users with a valid READ block token to perform any write operation on the same block.

Vulnerability Detail

The vulnerability in Apache Ozone allows authenticated users to bypass the intended access restrictions and perform unauthorized write operations on data blocks. This can lead to data corruption, unauthorized data modification, and potential data loss. The issue arises from the lack of proper validation of the access mode parameter in the block token. As a result, an attacker with a valid READ block token can exploit this vulnerability to perform write operations on the same block, bypassing the intended restrictions.

How To Fix

Minimum fixed version

1.2.0

This is the first release that contains the fix.

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Apache Ozone as soon as possible.

Conclusion

In conclusion, the vulnerability in Apache Ozone allows authenticated users to bypass access restrictions and perform unauthorized write operations on data blocks. Upgrading to Apache Ozone version 1.2.0 or later is the recommended solution to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for org.apache.ozone:ozone-main →