Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Ozone — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Apache Ozone, with AI-generated Chinese analysis, references, and POCs.

Vendor: Apache Software Foundation

CVE IDTitleCVSSSeverityPublished
CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets CWE-287 6.8 -2024-12-03
CVE-2023-39196 Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints CWE-287 5.3 Medium2024-02-07
CVE-2021-41532 Unauthenticated access to Ozone Recon HTTP endpoints CWE-200 5.3 -2021-11-19
CVE-2021-39236 Owners of the S3 tokens are not validated CWE-862 8.1 -2021-11-19
CVE-2021-39235 Access mode of block tokens are not enforced CWE-732 8.1 -2021-11-19
CVE-2021-39234 Raw block data can be read bypassing ACL/authorization CWE-20 6.8 -2021-11-19
CVE-2021-39233 Container-related datanode operations can be called without authorization CWE-306 7.5 -2021-11-19
CVE-2021-39232 Missing admin check for SCM related admin commands CWE-862 8.8 -2021-11-19
CVE-2021-39231 Missing authentication/authorization on internal RPC endpoints CWE-862 9.1 -2021-11-19
CVE-2021-36372 Original block tokens are persisted and can be retrieved CWE-273 9.8 -2021-11-19
CVE-2020-17517 Ozone S3 Gateway allows bucket and key access to non authenticated users CWE-285 7.5 -2021-04-27

All 11 known CVE vulnerabilities affecting Apache Ozone with full Chinese analysis, references, and POCs where available.