CVE-2021-39235: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2021-39235) was discovered in Apache Ozone versions prior to 1.2.0. The vulnerability was disclosed on November 19, 2021, and involves the Ozone Datanode's failure to properly check access mode parameters of block tokens. This issue affects the Apache Ozone distributed storage system and was tracked internally as HDDS-4558 and HDDS-4644 (Openwall List).

The vulnerability stems from a permission validation flaw where the Ozone Datanode fails to verify the access mode parameter of block tokens. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. It is categorized under CWE-732 (Incorrect Permission Assignment for Critical Resource) (NVD).

The vulnerability allows authenticated users who possess a valid READ block token to perform unauthorized write operations on the same block, potentially compromising the integrity of stored data (Openwall List).

The recommended mitigation is to upgrade to Apache Ozone version 1.2.0 or later, which contains the fix for this vulnerability (Openwall List).