Synopsis: Unauthorized bucket access possibilities against the IAM
implementation of MinIO server was discovered and has been fixed in
RELEASE.2019–06–15T23–07–18Z.
Severity: High
Who is affected: All users of IAM feature of MinIO server and gateway are
affected. It is highly recommended to upgrade.
Recommended Action for Users: All users are advised to upgrade their Minio
Read more
Synopsis: Two different privilege escalation possibilities against the IAM
implementation of MinIO server were discovered and has been fixed in
RELEASE.2019–04–04T18–31–46Z.
Severity: High
Who is affected: All users of the MinIO server are affected. Users of the MinIO
gateway are not affected. However, it is still recommended to upgrade.
Recommended Action for Users: All users
Read more
A primer on the new wordmark and mascot for MinIO - and what has stayed the same.
Read more
The new mascotThe new wordmarkWe are excited to introduce our new wordmark and
mascot. We will use the wordmark as our new logo and the bird will become the
MinIO mascot.
The new wordmark and mascot reflect the voice of our community. Most call us
min·eye·oh instead of mini-o and so we chose to reflect that pronunciation in
Read more
Synopsis: Possibility of spoofing authentication as another user on the Minio
server S3 and Admin API was discovered and has been fixed in
RELEASE.2019–02–20T22–44–29Z
Severity: Medium
Who is affected: All users using multi-user
[https://docs.minio.io/docs/minio-multi-user-quickstart-guide.html] feature are
affected. However, it is still recommended for everyone to upgrade.
Recommended Action for
Read more
Synopsis: Possibility of authentication bypass against the Minio server Storage
API was discovered and has been fixed in RELEASE.2019–02–12T21–58–47Z
Severity: Critical
Who is affected: The concerned issue is present in all the Minio releases after
October 4th 2018. All users of distributed erasure backend are affected. Users
of FS and Gateway backend are not affected.
Read more
Understanding compression and the risks it presents in the compression-ratio side channel.
Read more
Synopsis: A violation of the SSE-C security guarantees was discovered and has
been fixed in RELEASE.2018–07–10T01–42–11Z
[https://github.com/minio/minio/releases/tag/RELEASE.2018-07-10T01-42-11Z].
Severity: Low
Who is affected: All users who stored objects using the S3 SSE-C API and used
the same client-provided key at least twice for different objects.
Recommended Action for
Read more
Synopsis: A Denial-of-Service (DoS) vulnerability against the Minio server was
discovered and has been fixed in RELEASE.2018–05–25T19–49–13Z
[https://github.com/minio/minio/tree/RELEASE.2018-05-25T19-49-13Z]
Severity: Medium
Who is affected: All users of the signature V4 authentication are affected.
Users of the signature V2 authentication are not affected.
Recommended Action for Users: All users are
Read more