Apache Software Foundation Apache Ozone

• CVE-2024-45106 High 8.1 Apache Ozone: Improper authentication when generating S3 secrets 0.6%
• CVE-2023-39196 Medium 5.3 Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints 0.8%
• CVE-2021-41532 Unrated Unauthenticated access to Ozone Recon HTTP endpoints 2.4%
• CVE-2021-39236 Unrated Owners of the S3 tokens are not validated 2.6%
• CVE-2021-39235 Unrated Access mode of block tokens are not enforced 1.6%
• CVE-2021-39234 Unrated Raw block data can be read bypassing ACL/authorization 1.4%
• CVE-2021-39233 Unrated Container-related datanode operations can be called without authorization 2.4%
• CVE-2021-39232 Unrated Missing admin check for SCM related admin commands 1.7%
• CVE-2021-39231 Unrated Missing authentication/authorization on internal RPC endpoints 2.4%
• CVE-2021-36372 Unrated Original block tokens are persisted and can be retrieved 2.5%
• CVE-2020-17517 Unrated Ozone S3 Gateway allows bucket and key access to non authenticated users 2.3%