CVE-2024-45106

Description

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.

Reserved 2024-08-21 | Published 2024-12-03 | Updated 2024-12-03 | Assigner apache

Problem types

CWE-287 Improper Authentication

Product status

Default status
unaffected

1.4.0
affected

Credits

Ethan Rose reporter

Ivan Zlenko remediation developer

References

lists.apache.org/thread/rylnxwttp004kvotpk9j158vb238pfkm vendor-advisory

cve.org (CVE-2024-45106)

nvd.nist.gov (CVE-2024-45106)

Download JSON