漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Apache Ozone: Improper authentication when generating S3 secrets
Vulnerability Description
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.
CVSS Information
N/A
Vulnerability Type
认证机制不恰当
Vulnerability Title
Apache Ozone 安全漏洞
Vulnerability Description
Apache Ozone是美国阿帕奇（Apache）基金会的一个应用软件。一个面向Hadoop和云原生环境的可伸缩，冗余和分布式对象存储。 Apache Ozone 1.4.0版本存在安全漏洞，该漏洞源于S3网关中HTTP端点的身份验证不正确，从而允许Kerberos用户撤销和重新生成任何其他用户的S3机密。
CVSS Information
N/A
Vulnerability Type
N/A