CVE-2021-39235: Incorrect Permission Assignment for Critical Resource

November 19, 2021 (updated December 22, 2023)

In Apache Ozone, Ozone Datanode does not check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

References

www.openwall.com/lists/oss-security/2021/11/19/6
mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2021-39235

Detect and mitigate CVE-2021-39235 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →