CVE-2024-24747

Improper Privilege Management in go/github.com/minio/minio

Identifiers

GHSA-xx8w-mq23-29g4, CVE-2024-24747

Package Slug

go/github.com/minio/minio

Vulnerability

Improper Privilege Management

Description

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3:* actions, but also admin:* actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able to simply override their own s3 permissions to something more permissive. The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z.

Affected Versions

All versions before 0.0.0-20240131185645-0ae4915a9391

Solution

Upgrade to version 0.0.0-20240131185645-0ae4915a9391 or above.

Last Modified

2024-02-02

source