Alevsk

**Name of the Vulnerable Software and Affected Versions** MinIO (affected versions not specified) **Description** The issue affects MinIO, a High Performance Object Storage, where `admin` users authorized for `admin:ServerUpdate` can trigger an error that returns the content of the requested path. This allows access to contents at arbitrary paths readable by the MinIO process. **Recommendations** For all affected versions, users are advised to upgrade. As a temporary workaround, consider disabling the ServerUpdate API by denying the `admin:ServerUpdate` action for admin users via IAM policies.

**Name of the Vulnerable Software and Affected Versions** Minio console versions prior to 0.12.3 **Description** The Minio console is subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. This issue affects all users on release v0.12.2 and before. The estimated number of potentially affected devices worldwide is not available. There have been no reported real-world incidents where this issue was exploited. Technical details about exploitation include the use of external IDP authentication. To exploit this issue, an attacker would need to target the Operator Console with an external IDP enabled. **Recommendations** For versions prior to 0.12.3, update to 0.12.3 or newer. For users unable to upgrade, add automountServiceAccountToken: false to the operator-console deployment in Kubernetes and disable the external identity provider authentication by unsetting the `CONSOLE IDP URL`, `CONSOLE IDP CLIENT ID`, `CONSOLE IDP SECRET`, and `CONSOLE IDP CALLBACK` environment variables, then use the Kubernetes service account token instead.

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2021-01-30T00-20-58Z Description: The issue is related to a server-side request forgery vulnerability. The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. An attacker can modify the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built, allowing them to abuse functionality on the server to read or update internal resources. This can enable the attacker to read server configuration, connect to internal services, or perform post requests towards internal services that are not intended to be exposed. Recommendations: For versions prior to RELEASE.2021-01-30T00-20-58Z, upgrade to version RELEASE.2021-01-30T00-20-58Z or later. As a temporary workaround, consider disabling the browser front-end by setting the `MINIO BROWSER` environment variable to `off`.