Bug 2036252 (CVE-2021-43858) - CVE-2021-43858 minio: user privilege escalation in AddUser() admin API
Summary: CVE-2021-43858 minio: user privilege escalation in AddUser() admin API
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2021-43858
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2036253 2038206 2038207 2038208 2038209 2038210 2038211 2038212 2038213 2038214 2038215 2038216 2038217 2038218 2038219 2038220 2038221 2038222 2038223 2038224 2038225 2038226 2038227 2038228 2038229 2038230 2038231 2038232 2038233 2038234 2038235 2038236 2040439
Blocks: 2036258
TreeView+ depends on / blocked
 
Reported: 2021-12-30 17:55 UTC by Guilherme de Almeida Suckevicz
Modified: 2023-09-13 20:54 UTC (History)
15 users (show)

Fixed In Version: RELEASE.2021-12-27T07-23-18Z
Doc Type: If docs needed, set a value
Doc Text:
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API.
Clone Of:
Environment:
Last Closed: 2022-06-09 04:49:39 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:0735 0 None None None 2022-03-03 06:58:16 UTC
Red Hat Product Errata RHSA-2022:4956 0 None None None 2022-06-09 02:06:15 UTC

Description Guilherme de Almeida Suckevicz 2021-12-30 17:55:58 UTC 
MinIO is a Kubernetes native application for cloud storage. Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. The patch in version `RELEASE.2021-12-27T07-23-18Z` changes the accepted request body type and removes the ability to apply policy changes through this API. There is a workaround for this vulnerability: Changing passwords can be disabled by adding an explicit `Deny` rule to disable the API for users.

Reference:
https://github.com/minio/minio/security/advisories/GHSA-j6jc-jqqc-p6cx
Comment 1 Guilherme de Almeida Suckevicz 2021-12-30 17:56:17 UTC 
Created golang-github-minio tracking bugs for this issue:

Affects: fedora-all [bug 2036253]
Comment 3 errata-xmlrpc 2022-03-03 06:58:14 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8

Via RHSA-2022:0735 https://access.redhat.com/errata/RHSA-2022:0735
Comment 4 errata-xmlrpc 2022-06-09 02:06:13 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8

Via RHSA-2022:4956 https://access.redhat.com/errata/RHSA-2022:4956
Comment 5 Product Security DevOps Team 2022-06-09 04:49:36 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-43858
Note You need to log in before you can comment on or make changes to this bug.