Apache Ozone — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in Apache Ozone, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2024-45106	Apache Ozone: Improper authentication when generating S3 secrets CWE-287	6.8	-	2024-12-03
CVE-2023-39196	Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints CWE-287	5.3	Medium	2024-02-07
CVE-2021-41532	Unauthenticated access to Ozone Recon HTTP endpoints CWE-200	5.3	-	2021-11-19
CVE-2021-39236	Owners of the S3 tokens are not validated CWE-862	8.1	-	2021-11-19
CVE-2021-39235	Access mode of block tokens are not enforced CWE-732	8.1	-	2021-11-19
CVE-2021-39234	Raw block data can be read bypassing ACL/authorization CWE-20	6.8	-	2021-11-19
CVE-2021-39233	Container-related datanode operations can be called without authorization CWE-306	7.5	-	2021-11-19
CVE-2021-39232	Missing admin check for SCM related admin commands CWE-862	8.8	-	2021-11-19
CVE-2021-39231	Missing authentication/authorization on internal RPC endpoints CWE-862	9.1	-	2021-11-19
CVE-2021-36372	Original block tokens are persisted and can be retrieved CWE-273	9.8	-	2021-11-19
CVE-2020-17517	Ozone S3 Gateway allows bucket and key access to non authenticated users CWE-285	7.5	-	2021-04-27

All 11 known CVE vulnerabilities affecting Apache Ozone with full Chinese analysis, references, and POCs where available.