Description
In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/19/5
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C97d65498-7f8c-366f-1bea-5a74b6378f0d%40apache.org%3E
Related Vulnerabilities
CVE-2017-16172 Vulnerability in npm package section2.madisonjbrooks12
CVE-2023-5104 Vulnerability in npm package nocodb
CVE-2023-43497 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2020-4038 Vulnerability in npm package graphql-playground-html
CVE-2020-11023 Vulnerability in maven package org.webjars.bower:jquery