MinIO - MinIO Blog

Security Advisory

on 7 August 2019

Synopsis: A denial-of-service (DoS) possibility against the MinIO server was discovered and has been fixed in RELEASE.2019-08-07T01-59-21Z.Severity: MediumWho is affected: All users of the MinIO server version RELEASE.2019–03–06T22–47–10Z or newer are affected. Further, all users of the MinIO gateway version RELEASE.2019–03–06T22–47–10Z or newer using STS are affected as

Security Advisory

MinIO MinIO

on 16 June 2019

Synopsis: Unauthorized bucket access possibilities against the IAM implementation of MinIO server was discovered and has been fixed in RELEASE.2019–06–15T23–07–18Z.Severity: HighWho is affected: All users of IAM feature of MinIO server and gateway are affected. It is highly recommended to upgrade.Recommended Action for Users: All users are advised to upgrade their Minio deployments

Security Advisory

MinIO MinIO

on Security 4 April 2019

Synopsis: Two different privilege escalation possibilities against the IAM implementation of MinIO server were discovered and has been fixed in RELEASE.2019–04–04T18–31–46Z.Severity: HighWho is affected: All users of the MinIO server are affected. Users of the MinIO gateway are not affected. However, it is still recommended to upgrade.Recommended Action for Users: All users are

Security Advisory

MinIO MinIO

on Security 20 February 2019

Synopsis: Possibility of spoofing authentication as another user on the Minio server S3 and Admin API was discovered and has been fixed in RELEASE.2019–02–20T22–44–29ZSeverity: MediumWho is affected: All users using multi-user feature are affected. However, it is still recommended for everyone to upgrade.Recommended Action for Users: All users are advised to upgrade their Minio

Security Advisory

MinIO MinIO

on Security 13 February 2019

Synopsis: Possibility of authentication bypass against the Minio server Storage API was discovered and has been fixed in RELEASE.2019–02–12T21–58–47ZSeverity: CriticalWho is affected: The concerned issue is present in all the Minio releases after October 4th 2018. All users of distributed erasure backend are affected. Users of FS and Gateway backend are not affected. However, it

Security Advisory

MinIO MinIO

on Security 29 May 2018

Synopsis: A violation of the SSE-C security guarantees was discovered and has been fixed in RELEASE.2018–07–10T01–42–11Z.Severity: LowWho is affected: All users who stored objects using the S3 SSE-C API and used the same client-provided key at least twice for different objects.Recommended Action for Users: All users are advised to upgrade their Minio deployments

Security Advisory

MinIO MinIO

on Security 4 May 2018

Synopsis: A Denial-of-Service (DoS) vulnerability against the Minio server was discovered and has been fixed in RELEASE.2018–05–25T19–49–13ZSeverity: MediumWho is affected: All users of the signature V4 authentication are affected. Users of the signature V2 authentication are not affected.Recommended Action for Users: All users are advised to upgrade their Minio deployments to the latest version.

Here Comes The Flood

MinIO MinIO

on 4 April 2018

In 1994, EMC’s Symmetrix set an industry high-water mark with its max capacity of 1TB (TeraByte) for an enterprise storage system. In 2016, NetApp introduced the FAS9000 which in a 24-node cluster config holds about 172PB (PetaByte) raw. Increasing by 172,000x after 22 years — while dramatically improving performance and adding dozens of wonderful features — is decidedly impressive. But

Experimental Amazon S3 API support for Backblaze B2 Cloud Storage Service

MinIO MinIO

on Cloud Computing 3 October 2017

Some our community members have repeatedly asked for Backblaze B2 Cloud Storage and MinIO integration [1] . B2 is competitively priced and has a huge fan following. We also heard from Backblaze team that they are actively expanding their B2 cloud storage service. We added experimental support for Backblaze B2 backend in MinIO to add S3 compatible API support for their

Go implementation of Data At Rest Encryption

MinIO MinIO

on Security 7 September 2017

IntroductionEncrypting network traffic is becoming the default. There are standardized protocols like SSH and TLS as well as projects like Let’s Encrypt to protect data sent over the network. TLS for example takes a data stream, chunks the stream into messages and encrypts every message before sending it through the network. TLS ensures that each message is encrypted and