Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-F4B15F7D-D33A-4CD0-A97B-709D6AF0E43E (CVE-2021-41137): minio -- policy restriction issue

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: VID-F4B15F7D-D33A-4CD0-A97B-709D6AF0E43E (CVE-2021-41137): minio -- policy restriction issue

Severity
7
CVSS
(AV:N/AC:L/Au:S/C:P/I:P/A:P)
Published
10/12/2021
Created
11/08/2022
Added
11/04/2022
Modified
11/04/2022

Description

Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in `RELEASE.2021-10-13T00-23-17Z`. A downgrade back to release `RELEASE.2021-10-08T23-58-24Z` is available as a workaround.

Solution(s)

  • freebsd-upgrade-package-minio

References

  • CVE-2021-41137

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;