CVE-2024-45106: Apache Ozone: Improper authentication when generating S3 secrets
Apache Ozone could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication of an HTTP endpoint in the S3 Gateway. By sending a specially crafted request, an attacker could exploit this vulnerability to revoke and regenerate the S3 secrets of any other user.
Other sources
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators.
Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45106?
CVE-2024-45106 has a critical severity rating due to the potential for remote authenticated attackers to bypass security restrictions.
How do I fix CVE-2024-45106?
To mitigate CVE-2024-45106, upgrade to Apache Ozone version 1.4.1 or later.
Which software is affected by CVE-2024-45106?
CVE-2024-45106 affects Apache Ozone version 1.4.0 and IBM Security QRadar EDR versions up to 3.12.
What types of attacks can exploit CVE-2024-45106?
An attacker can exploit CVE-2024-45106 by sending specially crafted requests to revoke and regenerate S3 security credentials.
Is authentication affected by CVE-2024-45106?
Yes, CVE-2024-45106 involves improper authentication of an HTTP endpoint in the S3 Gateway.