830137 – net-fs/minio: user privilege escalation

Bug 830137 - net-fs/minio: user privilege escalation

Summary: net-fs/minio: user privilege escalation

Status:	RESOLVED DUPLICATE of bug 850547

Alias:	None

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:	https://github.com/minio/minio/securi...
Whiteboard:	B3 [ebuild]
Keywords:

Depends on:
Blocks:

Reported:	2021-12-28 04:56 UTC by John Helmert III
Modified:	2022-08-04 03:03 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description John Helmert III archtester

2021-12-28 04:56:36 UTC

CVE-2021-43858 (https://github.com/minio/minio/commit/5a96cbbeaabd0a82b0fe881378e7c21c85091abf):

MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.

Comment 1 John Helmert III archtester

2022-08-04 03:03:24 UTC


*** This bug has been marked as a duplicate of bug 850547 ***