Aead

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2021-01-30T00-20-58Z Description: The issue is related to a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. An attacker can modify the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built, allowing them to abuse functionality on the server to read or update internal resources. This can enable the attacker to read server configuration, connect to internal services, or perform post requests towards internal services that are not intended to be exposed. Recommendations: For versions prior to RELEASE.2021-01-30T00-20-58Z, upgrade to version RELEASE.2021-01-30T00-20-58Z or later. As a temporary workaround, consider disabling the browser front-end by setting the `MINIO BROWSER` environment variable to `off`.

**Name of the Vulnerable Software and Affected Versions** Minio S3 server versions prior to RELEASE.2018-05-16T23-35-33Z **Description** The issue is related to an Allocation of Memory Without Limits or Throttling in the write-to-RAM functionality, which can result in a Denial of Service. This can be exploited by sending V4-(pre)signed requests with large bodies. **Recommendations** For versions prior to RELEASE.2018-05-16T23-35-33Z, consider updating to a version that includes the fix committed after 9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7 to resolve the issue. As a temporary workaround, consider restricting the size of requests or limiting the use of V4-(pre)signed requests to minimize the risk of exploitation.