Description
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/19/6
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
Related Vulnerabilities
CVE-2019-6284 Vulnerability in maven package org.webjars.npm:node-sass
CVE-2022-36881 Vulnerability in maven package org.jenkins-ci.plugins:git-client
CVE-2019-10406 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2022-28157 Vulnerability in maven package com.surenpi.jenkins:phoenix-autotest