maven package report

Is org.apache.ozone:ozone-main safe?

7 known vulnerabilities, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

2.5%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-86fh-j58m-7pf5, the advisory selected below

// advisories

GHSA-86fh-j58m-7pf5

CRITICALCVE-2021-36372

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.

Affected: < 1.2.0
Fixed in: 1.2.0
Weakness: CWE-273
Published: 2021-11-23
Source: github

GHSA NVD MITRE reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 02:58 UTC. The most recent advisory here was published 2024-02-07. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is org.apache.ozone:ozone-main safe? maven package security report | CyberXYZ