GHSA-c8cw-2c5j-xff3
Incorrect Authorization in Apache Ozone
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.ozone:ozone-main | < 1.2.0 | 1.2.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
References
External links from the advisory. They lead to third-party sites.