CVE-2023-39196 json
Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints
published 2024-02-07 2 y ago modified 2026-06-17 4 mo ago also GHSA-6726-2rx3-cgwh , EUVD-2024-0531
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Improper Authentication vulnerability in Apache Ozone.
The vulnerability allows an attacker to download metadata internal to the Storage Container Manager service without proper authentication. The attacker is not allowed to do any modification within the Ozone Storage Container Manager service using this vulnerability. The accessible metadata does not contain sensitive information that can be used to exploit the system later on, and the accessible data does not make it possible to gain access to actual user data within Ozone. This issue affects Apache Ozone: 1.2.0 and subsequent releases up until 1.3.0.
Users are recommended to upgrade to version 1.4.0, which fixes the issue.
Patch / fix
- maven org.apache.ozone:ozone-main 1.4.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.79% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.ozone:ozone-main | >=1.2.0, <1.4.0 |
1.4.0 |
Affected products
- Apache Software Foundation Apache Ozone
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
lists.apache.org
/thread/o96ct5t7kj5cgrmmfc6756m931t08nky
vendor-advisory, web, issue-tracking
-
openwall.com
/lists/oss-security/2024/02/07/2
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-39196
advisory
-
github.com
/apache/ozone
package
Sources
- CVE List CVE-2023-39196
- GitHub Advisory GHSA-6726-2rx3-cgwh
- NVD CVE-2023-39196
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.