Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 23 Oct 2021 19:50:18 GMT
From:      Steve Wills <swills@FreeBSD.org>
To:        ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org
Subject:   git: 268b61bcb631 - main - security/vuxml: document minio issue
Message-ID:  <202110231950.19NJoIbS036384@gitrepo.freebsd.org>

next in thread | raw e-mail | index | archive | help
The branch main has been updated by swills:

URL: https://cgit.FreeBSD.org/ports/commit/?id=268b61bcb631ae9684a93c88a2291dbede8007de

commit 268b61bcb631ae9684a93c88a2291dbede8007de
Author:     Steve Wills <swills@FreeBSD.org>
AuthorDate: 2021-10-23 19:49:15 +0000
Commit:     Steve Wills <swills@FreeBSD.org>
CommitDate: 2021-10-23 19:50:04 +0000

    security/vuxml: document minio issue
---
 security/vuxml/vuln-2021.xml | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
index 0d5daf169810..d0f4bb5cc273 100644
--- a/security/vuxml/vuln-2021.xml
+++ b/security/vuxml/vuln-2021.xml
@@ -1,3 +1,34 @@
+  <vuln vid="f4b15f7d-d33a-4cd0-a97b-709d6af0e43e">
+    <topic>minio -- policy restriction issue</topic>
+    <affects>
+      <package>
+	<name>minio</name>
+	<range><lt>2021.10.23.03.28.24</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">;
+	<p>minio developers report:</p>
+	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c">;
+	  <p>Looks like policy restriction was not working properly for normal users when they are not svc or STS accounts.</p>
+	  <ul>
+	    <li>svc accounts are now properly fixed to get right permissions when its inherited, so we do not have to set 'owner = true'</li>
+	    <li>sts accounts have always been using right permissions, do not need an explicit lookup</li>
+	    <li>regular users always have proper policy mapping</li>
+	  </ul>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2021-41137</cvename>
+      <url>https://github.com/minio/minio/security/advisories/GHSA-v64v-g97p-577c</url>;
+    </references>
+    <dates>
+      <discovery>2021-10-12</discovery>
+      <entry>2021-10-23</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="8d65aa3b-31ce-11ec-8c32-a14e8e520dc7">
     <topic>mailman -- brute-force vuln on list admin password, and CSRF vuln in releases before 2.1.35</topic>
     <affects>



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202110231950.19NJoIbS036384>