CVE-2021-41137 log
| Source |
|
| Severity | High |
| Remote | Yes |
| Type | Access restriction bypass |
| Description | All users on MinIO release RELEASE.2021-10-10T16-53-30Z are affected by a vulnerability that involves bypassing policy restrictions on regular users. Normally, checkKeyValid() should return owner true for rootCreds. In the affected version, policy restriction did not work properly for users who did not have service (svc) or security token service (STS) accounts. This issue is fixed in RELEASE.2021-10-13T00-23-17Z. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-2467 | minio | 2021.09.03-1 | High | Not affected |