What is GHSA-86fh-j58m-7pf5?

GHSA-86fh-j58m-7pf5 is a security advisory published by GitHub Security Advisories with Critical severity. Improper Privilege Management in Apache Ozone

Which CVE IDs does GHSA-86fh-j58m-7pf5 cover?

GHSA-86fh-j58m-7pf5 covers the following CVE IDs: CVE-2021-36372. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-86fh-j58m-7pf5?

GHSA-86fh-j58m-7pf5 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-86fh-j58m-7pf5?

GHSA-86fh-j58m-7pf5 affects 1 product, including: maven/org.apache.ozone:ozone-main:\u003c 1.2.0.

GHSA-86fh-j58m-7pf5CriticalCVSS 9.8

Improper Privilege Management in Apache Ozone

Vendor

GitHub Security Advisories

Published

November 23, 2021

Last Modified

January 31, 2024

🔗 CVE IDs covered (1)

CVE-2021-36372 →

📋 Description

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

🎯 Affected products1

maven/org.apache.ozone:ozone-main:< 1.2.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-36372
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/11/19/1
https://github.com/advisories/GHSA-86fh-j58m-7pf5