oss-security - CVE-2021-39232: Apache Ozone: Missing admin check for SCM related admin commands

Message-ID: <f8bd21d5-0fd8-d02d-f4c9-b54deff5a097@apache.org>
Date: Thu, 18 Nov 2021 23:04:45 +0000
From: Siddharth Wagle <swagle@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-39232: Apache Ozone: Missing admin check for SCM related
 admin commands 

Description:

Certain admin related SCM commands can be executed by any authenticated users, not just by admins. 

This issue is being tracked as HDDS-4530

Mitigation:

Upgrade to Apache Ozone release version 1.2.0

Credit:

    Apache Ozone would like to thank Wei-Chiu Chuang for reporting this issue.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.