Date: Sun, 31 Jan 2021 21:55:28 +0000 (UTC) From: Steve Wills <swills@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r563534 - head/security/vuxml Message-ID: <202101312155.10VLtSBd029789@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: swills Date: Sun Jan 31 21:55:28 2021 New Revision: 563534 URL: https://svnweb.freebsd.org/changeset/ports/563534 Log: Document minio issue Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Jan 31 21:54:41 2021 (r563533) +++ head/security/vuxml/vuln.xml Sun Jan 31 21:55:28 2021 (r563534) @@ -77,6 +77,34 @@ Notes: * Do not forget port variants (linux-f10-libxml2, libxml2, etc.) --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="8ec7d426-055d-46bc-8f5a-a9d73a5a71ab"> + <topic>minio -- Server Side Request Forgery</topic> + <affects> + <package> + <name>minio</name> + <range><lt>2021.01.30.00.20.58</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Minio developers report:</p> + <blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q">; + <p>Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.</p> + <p>All users are advised to upgrade ASAP.</p> + <p>The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).</p> + <p>In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.</p> + </blockquote> + </body> + </description> + <references> + <url>https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q</url>; + </references> + <dates> + <discovery>2021-01-29</discovery> + <entry>2021-01-31</entry> + </dates> + </vuln> + <vuln vid="5d91370b-61fd-11eb-b87a-901b0ef719ab"> <topic>FreeBSD -- Xen guests can triger backend Out Of Memory</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202101312155.10VLtSBd029789>