← All credits
Apache Ozone would like to thank Marton Elek for reporting this issue.
6 vulnerability records and advisories credit this contributor.
CVE-2021-39235
Access mode of block tokens are not enforced
CVE-2021-39236
Owners of the S3 tokens are not validated
CVE-2021-39231
Missing authentication/authorization on internal RPC endpoints
CVE-2021-39234
Raw block data can be read bypassing ACL/authorization
CVE-2021-39233
Container-related datanode operations can be called without authorization
CVE-2021-36372
Original block tokens are persisted and can be retrieved