CVE Vulnerabilities

CVE-2023-25812

Published: Feb 21, 2023 | Modified: Nov 07, 2023
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a Deny policy on ByPassGoverance. Ideally, minio should return Access Denied to all users attempting to DELETE a versionId with the special header X-Amz-Bypass-Governance-Retention: true. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

Affected Software

Name Vendor Start Version End Version
Minio Minio 2020-04-10t03-34-42z (including) 2023-02-17t17-52-43z (excluding)
Golang-github-minio-minio-go Ubuntu bionic *
Golang-github-minio-minio-go Ubuntu kinetic *
Golang-github-minio-minio-go Ubuntu lunar *
Golang-github-minio-minio-go Ubuntu mantic *
Golang-github-minio-minio-go Ubuntu trusty *
Golang-github-minio-minio-go Ubuntu xenial *
Golang-github-minio-minio-go-v7 Ubuntu kinetic *
Golang-github-minio-minio-go-v7 Ubuntu lunar *
Golang-github-minio-minio-go-v7 Ubuntu mantic *
Golang-github-minio-minio-go-v7 Ubuntu trusty *
Golang-github-minio-minio-go-v7 Ubuntu xenial *

References