Description
In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/19/1
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C5029c1ac-4685-8492-e3cb-ab48c5c370cf%40apache.org%3E
Related Vulnerabilities
CVE-2020-6429 Vulnerability in npm package electron
CVE-2017-9096 Vulnerability in maven package com.itextpdf:itextpdf
CVE-2016-10591 Vulnerability in npm package prince
CVE-2018-12544 Vulnerability in maven package io.vertx:vertx-web-api-contract
CVE-2019-9212 Vulnerability in maven package com.alipay.sofa:hessian