Product
AiStor Logo
Overview
What is AIStor?
Features
Replication Replication Versioning Versioning Observability Observability Encryption Encryption Key Management Server Key Management Server Key Management Server S3 Compatibility Object Immutability Object Immutability Catalog Catalog Object Prompt Object Prompt xxx Identity + Access Mgt Firewall Firewall AIHub AIHub Lifecycle Lifecycle Cache Cache Events and Lambdas Events and Lambdas Console Console
Tools
Erasure Code Calculator Erasure Code Calculator Determine your raw and usable capacity across a range of erasure coding settings. Reference Hardware Reference Hardware MinIO’s recommended Configuration and reference hardware for building large scale data infrastructure.
Solutions
AI Storage Learn how MinIO is leading the AI storage market from its exclusive features to performance at scale. HDFS Migration Modernize and simplify your big data storage infrastructure with cloud native storage with AIStor. Snowflake Learn how to leverage Snowflake external tables to query data without having to move it.
Integrations Integrations with MinIO Browse our expansive list of
integrations with links to the relevant
documentation.
Veeam Learn how MinIO and Veeam have partnered deliver superior RTO and RPO. Modern Datalakes Learn how modern, multi-engine data lakeshouses depend on MinIO's AIStor. Equinix Repatriate your data onto the cloud you control with MinIO and Equinix. SQL Server Learn how to leverage SQL Server 2022 with MinIO to run queries on your data without having to move it. Commvault Learn how Commvault and MinIO are partnered to deliver performance at scale for mission critical backup and restore workloads. Hybrid Cloud Learn how enterprises use MinIO to build AI data infrastructure that runs on any cloud - public, private or colo. Splunk Find out how MinIO is delivering performance at scale for Splunk SmartStores. VMware Discover how MinIO integrates with VMware across the portfolio from the Persistent Data platform to TKG and how we support their Kubernetes ambitions.
Open Source
Github Community Explore, experiment, ask questions and contribute. Docs Development guides. Slack Channel Open Forum for discussing topics related to MinIO.
Download MinIO Object Store Download MinIO Object Store Get MinIO's open source server, client, and SDK.
Resources
Resources Home Browse our library of white papers, solution briefs, benchmarks and videos. Blog Product updates, company news, and educational content. Training Learn the MinIO Way and Become a Data Infrastructure Expert.
Events Events Join us to take advantage to meet with MinIO partners, employees, and subject-matter experts.
Partner Pricing
Login Download

Security Advisory

MinIO MinIO MinIO on Security Advisory

Synopsis: Two different privilege escalation possibilities against the IAM implementation of MinIO server were discovered and has been fixed in RELEASE.2019–04–04T18–31–46Z.

Severity: High

Who is affected: All users of the MinIO server are affected. Users of the MinIO gateway are not affected. However, it is still recommended to upgrade.

Recommended Action for Users: All users are advised to upgrade their Minio deployments to the latest version. This issue is fixed in version RELEASE.2019–04–04T18–31–46Z (https://dl.minio.io/server/minio/release/linux-amd64/minio). If users/applications have access to the MinIO server using separate access/secret key pairs (IAM multi-user system) it is recommended to change at least the admin access credentials and check the IAM user access policies. Additionally, you should also change the access credentials of all IAM users.

Description: An authenticated IAM user can access the internal MinIO server configuration.

  • The first privilege escalation vulnerability affects all MinIO server and allows an IAM user to read from or write to the internal MinIO server configuration by sending either a malicious S3 API GET/PUT request or a malicious JWT POST request.
  • The second privilege escalation vulnerability affects only MinIO servers running in distributed erasure-coded backend mode and allows an IAM user to read from or write to the internal MinIO server configuration using the inter-node communication protocol of the MinIO servers.

The issue was discovered through an internal security audit and a patch has been submitted to only allow requests, authenticated with the admin credentials, to access the internal MinIO server configuration. The patch has been reviewed and accepted, and a new release has been made.

A successful exploit can be used to impersonate other IAM users or obtain the admin credentials, and thereby steal or corrupt your data. Further, it will not cause suspicious server behavior. At the time of writing, this exploit has not been observed in the wild.