~ / search / GHSA-5993-wwpg-m92c

GHSA-5993-wwpg-m92c

Apache Ozone user impersonation due to non-validation of Ozone S3 tokens

Source: GitHub Advisory Database (reviewed) High CVE-2021-39236

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.hadoop:hadoop-ozone-ozone-manager < 1.2.0 1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

References

External links from the advisory. They lead to third-party sites.