Description
In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Remediation
References
http://www.openwall.com/lists/oss-security/2021/11/19/6
https://mail-archives.apache.org/mod_mbox/ozone-dev/202111.mbox/%3C93f88246-4320-7423-0dac-ec7a07f47455%40apache.org%3E
Related Vulnerabilities
CVE-2021-33604 Vulnerability in maven package com.vaadin:flow-server
CVE-2020-28498 Vulnerability in maven package org.webjars.npm:elliptic
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-media-embed
CVE-2023-33725 Vulnerability in maven package org.broadleafcommerce:broadleaf
CVE-2020-7729 Vulnerability in maven package org.webjars.npm:grunt