Read the docs
TI-2024-30207 Aliases CVE-2024-45106GHSA-rcq8-9q3j-98mw

Apache Ozone: Improper authentication when generating S3 secrets

Priority LOW 38CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators. Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00576 47th percentileScored 2026-11-07
Fix Fixed org.apache.ozone:ozone (Maven): 1.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Ozone1.4.0—No fix listedCNA
—org.apache.ozone:ozone (Maven)1.4.0 to before 1.4.11.4.1Patch availableGHSA-rcq8-9q3j-98mw
  • Apache Ozone VendorApache Affected 1.4.0 Fixed in — No fix listed CNA
  • org.apache.ozone:ozone (Maven) Vendor— Affected 1.4.0 to before 1.4.1 Fixed in 1.4.1 Patch available GHSA-rcq8-9q3j-98mw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:ozone:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableApache
  • cpe:2.3:a:apache:ozone:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-rcq8-9q3j-98mw org.apache.ozone:ozone (Maven) Fixed in 1.4.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45106
  2. 2026-10-03 Alias added: GHSA-rcq8-9q3j-98mw

References

Advisory 2

Other 3

  • TI-2021-14726 Original block tokens are persisted and can be retrieved CVSS 3.1CRITICAL 9.8
  • TI-2021-16618 Container-related datanode operations can be called without authorization CVSS 3.1CRITICAL 9.1
  • TI-2021-16616 Missing authentication/authorization on internal RPC endpoints CVSS 3.1CRITICAL 9.1
  • TI-2021-16621 Owners of the S3 tokens are not validated CVSS 3.1HIGH 8.8
  • TI-2021-16617 Missing admin check for SCM related admin commands CVSS 3.1HIGH 8.8
  • TI-2020-13266 Ozone S3 Gateway allows bucket and key access to non authenticated users CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences