CVE-2021-39231: Exposure of Resource to Wrong Sphere

November 19, 2021 (updated January 21, 2024)

In Apache Ozone, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

References

www.openwall.com/lists/oss-security/2021/11/19/2
mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C110cd117-75ed-364b-cd38-3effd20f2183%40apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2021-39231

Code Behaviors & Features

Detect and mitigate CVE-2021-39231 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →