CVE-2021-39231

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-39231
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39231.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-39231
Aliases
Published
2021-11-19T10:15:08.110Z
Modified
2026-07-08T23:57:48.671444Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
[none]
Details

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

References

Affected packages

Git / github.com/apache/ozone

Affected ranges

Type
GIT
Repo
https://github.com/apache/ozone
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9ee6f1872dca8469057d3c7bf880931c0e7b7f3e
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:apache:ozone:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

ozone-1.*
ozone-1.2.0-RC0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39231.json"