Поиск уязвимостей
Количество 8
Количество 8
ALT-PU-2022-3382
ALT-PU-2022-3382: package `minio` update to version 2022.12.07-alt1
ALT-PU-2023-1908
ALT-PU-2023-1908: package `minio` update to version 2023.05.18-alt1
CVE-2022-24842
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
CVE-2022-24842
MinIO is a High Performance Object Storage released under GNU Affero G ...
CVE-2022-35919
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies.
CVE-2022-35919
MinIO is a High Performance Object Storage released under GNU Affero G ...
CVE-2022-31028
MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.
CVE-2022-31028
MinIO is a multi-cloud object storage solution. Starting with version ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| ALT-PU-2022-3382 ALT-PU-2022-3382: package `minio` update to version 2022.12.07-alt1 | CVSS3: 8.8 | почти 4 года назад | |
| ALT-PU-2023-1908 ALT-PU-2023-1908: package `minio` update to version 2023.05.18-alt1 | CVSS3: 8.8 | больше 3 лет назад | |
 | CVE-2022-24842 MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well. | CVSS3: 8.8 | 2% Низкий | больше 4 лет назад |
| CVE-2022-24842 MinIO is a High Performance Object Storage released under GNU Affero G ... | CVSS3: 8.8 | 2% Низкий | больше 4 лет назад |
| CVE-2022-35919 MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. In affected versions all 'admin' users authorized for `admin:ServerUpdate` can selectively trigger an error that in response, returns the content of the path requested. Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. Users are advised to upgrade. Users unable to upgrade may disable ServerUpdate API by denying the `admin:ServerUpdate` action for your admin users via IAM policies. | CVSS3: 2.7 | 52% Средний | больше 4 лет назад |
| CVE-2022-35919 MinIO is a High Performance Object Storage released under GNU Affero G ... | CVSS3: 2.7 | 52% Средний | больше 4 лет назад |
| CVE-2022-31028 MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients. | CVSS3: 7.5 | 3% Низкий | больше 4 лет назад |
| CVE-2022-31028 MinIO is a multi-cloud object storage solution. Starting with version ... | CVSS3: 7.5 | 3% Низкий | больше 4 лет назад |
Уязвимостей на страницу