CVE-2021-36372: Original block tokens are persisted and can be retrieved
First published: Fri Nov 19 2021(Updated: )
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Ozone | <1.2.0 | |
| maven/org.apache.ozone:ozone-main | <1.2.0 | 1.2.0 |
| <1.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-36372?
The severity of CVE-2021-36372 is critical with a CVSS score of 9.8.
What is the vulnerability description of CVE-2021-36372?
CVE-2021-36372 is a vulnerability in Apache Ozone versions prior to 1.2.0 where initially generated block tokens are persisted to the metadata database and can be retrieved by authenticated users even after access is revoked.
How can an authenticated user exploit CVE-2021-36372?
Authenticated users with permission to the key in Apache Ozone versions prior to 1.2.0 can exploit CVE-2021-36372 by using the initially generated block tokens even after access is revoked.
How can I fix CVE-2021-36372?
To fix CVE-2021-36372, upgrade to Apache Ozone version 1.2.0 or later.
Where can I find more information about CVE-2021-36372?
You can find more information about CVE-2021-36372 in the references provided: [http://www.openwall.com/lists/oss-security/2021/11/19/1](http://www.openwall.com/lists/oss-security/2021/11/19/1) and [https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E](https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E).
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-86fh-j58m-7pf5
- alias/CVE-2021-36372
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- collector/github-advisory
- vendor/apache
- canonical/apache ozone
- package-manager/maven