title: Original block tokens are persisted and can be retrieved
description: In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
problem types: CWE-273 Improper Check for Dropped Privileges
affected:
{
product: Apache Ozone
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 1.1, status: affected, version: 1.1, versionType: custom
}
workarounds: Upgrade to Apache Ozone release version 1.2.0