CVE-2021-39235: Incorrect Permission Assignment for Critical Resource

November 23, 2021

In Apache Ozone before 1.2.0, Ozone Datanode doesn’t check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

References

github.com/advisories/GHSA-c6j7-4fr9-c76p
nvd.nist.gov/vuln/detail/CVE-2021-39235

Code Behaviors & Features

Detect and mitigate CVE-2021-39235 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →