What is GHSA-c6j7-4fr9-c76p?

GHSA-c6j7-4fr9-c76p is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect permissions in Apache Ozone

Which CVE IDs does GHSA-c6j7-4fr9-c76p cover?

GHSA-c6j7-4fr9-c76p covers the following CVE IDs: CVE-2021-39235. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c6j7-4fr9-c76p?

GHSA-c6j7-4fr9-c76p has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-c6j7-4fr9-c76p?

GHSA-c6j7-4fr9-c76p affects 1 product, including: maven/org.apache.ozone:ozone-main:\u003c 1.2.0.

GHSA-c6j7-4fr9-c76pMediumCVSS 6.5

Incorrect permissions in Apache Ozone

Vendor

GitHub Security Advisories

Published

November 23, 2021

Last Modified

November 14, 2023

🔗 CVE IDs covered (1)

CVE-2021-39235 →

📋 Description

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

🎯 Affected products1

maven/org.apache.ozone:ozone-main:< 1.2.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-39235
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
http://www.openwall.com/lists/oss-security/2021/11/19/6
https://github.com/advisories/GHSA-c6j7-4fr9-c76p