Saturday, March 20, 2021

FreeBSD: VID-B073677F-253A-41F9-BF2B-2D16072A25F6: minio -- MITM attack

Description
minio developer report: This is a security issue because it enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature.
Solution(s)
  • freebsd-upgrade-package-minio


  • None
     

    Copyright © 2020 Cyber Details - Vulnerability Database™

    Thanks for everything Templateism - You should have written the code a little more complicated