High severity8.1NVD Advisory· Published Dec 3, 2024· Updated Jun 17, 2026
CVE-2024-45106
CVE-2024-45106
Description
Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators.
Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.ozone:ozoneMaven | >= 1.4.0, < 1.4.1 | 1.4.1 |
Affected products
3- Apache Software Foundation/Apache Ozonev5Range: 1.4.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-rcq8-9q3j-98mwghsaADVISORY
- lists.apache.org/thread/rylnxwttp004kvotpk9j158vb238pfkmnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-45106ghsaADVISORY
- www.openwall.com/lists/oss-security/2024/12/02/1nvdMailing ListWEB
- github.com/apache/ozone/pull/5233ghsaWEB
News mentions
0No linked articles in our index yet.