CVE-2021-39233 - OpenCVE

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Ozone

Configuration 1 [-]

cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2021/11/19/4
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2021-11-19T09:20:20

Updated: 2024-08-04T01:58:18.231Z

Reserved: 2021-08-17T00:00:00

Link: CVE-2021-39233

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-11-19T10:15:08.207

Modified: 2023-11-07T03:37:37.377

Link: CVE-2021-39233

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Apache Ozone", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.1", "status": "affected", "version": "1.1", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Apache Ozone would like to thank Marton Elek for reporting this issue."}], "descriptions": [{"lang": "en", "value": "In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": " cwe-306 Missing Authentication for Critical Function ", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-19T12:06:52", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E"}, {"name": "[oss-security] 20211118 CVE-2021-39233: Apache Ozone: Container-related datanode operations can be called without authorization", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/11/19/4"}], "source": {"defect": ["HDDS-4729", "HDDS-5236"], "discovery": "UNKNOWN"}, "title": "Container-related datanode operations can be called without authorization", "workarounds": [{"lang": "en", "value": "Upgrade to Apache Ozone release version 1.2.0"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-39233", "STATE": "PUBLIC", "TITLE": "Container-related datanode operations can be called without authorization"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Ozone", "version": {"version_data": [{"version_affected": "<=", "version_name": "1.1", "version_value": "1.1"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Apache Ozone would like to thank Marton Elek for reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": " cwe-306 Missing Authentication for Critical Function "}]}]}, "references": {"reference_data": [{"name": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E", "refsource": "MISC", "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E"}, {"name": "[oss-security] 20211118 CVE-2021-39233: Apache Ozone: Container-related datanode operations can be called without authorization", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/11/19/4"}]}, "source": {"defect": ["HDDS-4729", "HDDS-5236"], "discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Upgrade to Apache Ozone release version 1.2.0"}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:58:18.231Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E"}, {"name": "[oss-security] 20211118 CVE-2021-39233: Apache Ozone: Container-related datanode operations can be called without authorization", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/11/19/4"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-39233", "datePublished": "2021-11-19T09:20:20", "dateReserved": "2021-08-17T00:00:00", "dateUpdated": "2024-08-04T01:58:18.231Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*", "matchCriteriaId": "9DCCB9A0-2922-4ED3-BF73-E84FDDAE7205", "versionEndExcluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client."}, {"lang": "es", "value": "En Apache Ozone versiones anteriores a 1.2.0, las peticiones de Datanode relacionadas con contenedores de Ozone Datanode no estaban apropiadamente autorizadas y pod\u00edan ser llamadas por cualquier cliente"}], "id": "CVE-2021-39233", "lastModified": "2023-11-07T03:37:37.377", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-19T10:15:08.207", "references": [{"source": "security@apache.org", "tags": ["Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/11/19/4"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C394a9a73-44dd-b5db-84d8-607c3226eb00%40apache.org%3E"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@apache.org", "type": "Secondary"}]}