https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:33:09 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-06172 bdu:2024-06172 https://cve.radiocsirt.org/vuln/bdu:2024-06172 https://cve.radiocsirt.org/vuln/bit-minio-2024-36107 <p><strong>Affected:</strong> Bitnami: minio</p> <p>MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.</p> <p><strong>Affected:</strong> Bitnami: minio</p> <p>MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.</p> https://cve.radiocsirt.org/vuln/bit-minio-2024-36107 https://cve.radiocsirt.org/vuln/cnvd-2024-25257 cnvd-2024-25257 https://cve.radiocsirt.org/vuln/cnvd-2024-25257 https://cve.radiocsirt.org/vuln/euvd-2026-161068 EUVD-2026-161068 https://cve.radiocsirt.org/vuln/euvd-2026-161068 https://cve.radiocsirt.org/vuln/fkie_cve-2024-36107 <p>MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.</p> <p>MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. `If-Modified-Since` and `If-Unmodified-Since` headers when used with anonymous requests by sending a random object name requests can be used to determine if an object exists or not on the server on a specific bucket and also gain access to some amount of information such as `Last-Modified (of the latest version)`, `Etag (of the latest version)`, `x-amz-version-id (of the latest version)`, `Expires (metadata value of the latest version)`, `Cache-Control (metadata value of the latest version)`. This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object. This issue has been addressed in commit `e0fe7cc3917`. Users must upgrade to RELEASE.2024-05-27T19-17-46Z for the fix. There are no known workarounds for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-36107 https://cve.radiocsirt.org/vuln/ghsa-95fr-cm4m-q5p9 <p><strong>Affected:</strong> Go: github.com/minio/minio</p> <p>### Impact [If-Modified-Since](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since) [If-Unmodified-Since](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since)</p> <p>Headers when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information such as</p> <p>``` Last-Modified (of the latest version) Etag (of the latest version) x-amz-version-id (of the latest version) Expires (metadata value of the latest version) Cache-Control (metadata value of the latest version) ```</p> <p>This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object.</p> <p>### Patches Yes this issue has been already fixed in</p> <p>``` commit e0fe7cc391724fc5baa85b45508f425020fe4272 (HEAD -&gt; master, origin/master) Author: Harshavardhana &lt;harsha@minio.io&gt; Date: Mon May 27 12:17:46 2024 -0700</p> <p>fix: information disclosure bug in preconditions GET (#19810) precondition check was being honored before, validating if anonymous access is allowed on the metadata of an object, leading to metadata disclosure of the following headers. ``` Last-Modified Etag x-amz-version-id Expires: Cache-Control: ``` although the information presented is minimal in nature, and of opaque nature. It still simply discloses that an…</p> <p><strong>Affected:</strong> Go: github.com/minio/minio</p> <p>### Impact [If-Modified-Since](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Modified-Since) [If-Unmodified-Since](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-Unmodified-Since)</p> <p>Headers when used with anonymous requests by sending a random object name requests you can figure out if the object exists or not on the server on a specific bucket and also gain access to some amount of information such as</p> <p>``` Last-Modified (of the latest version) Etag (of the latest version) x-amz-version-id (of the latest version) Expires (metadata value of the latest version) Cache-Control (metadata value of the latest version) ```</p> <p>This conditional check was being honored before validating if the anonymous access is indeed allowed on the metadata of an object.</p> <p>### Patches Yes this issue has been already fixed in</p> <p>``` commit e0fe7cc391724fc5baa85b45508f425020fe4272 (HEAD -&gt; master, origin/master) Author: Harshavardhana &lt;harsha@minio.io&gt; Date: Mon May 27 12:17:46 2024 -0700</p> <p>fix: information disclosure bug in preconditions GET (#19810) precondition check was being honored before, validating if anonymous access is allowed on the metadata of an object, leading to metadata disclosure of the following headers. ``` Last-Modified Etag x-amz-version-id Expires: Cache-Control: ``` although the information presented is minimal in nature, and of opaque nature. It still simply discloses that an…</p> https://cve.radiocsirt.org/vuln/ghsa-95fr-cm4m-q5p9 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1250 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MinIO ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in MinIO ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1250