svn commit: r563534 - head/security/vuxml

Sun Jan 31 21:55:29 UTC 2021

Author: swills
Date: Sun Jan 31 21:55:28 2021
New Revision: 563534
URL: https://svnweb.freebsd.org/changeset/ports/563534

Log:
  Document minio issue

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sun Jan 31 21:54:41 2021	(r563533)
+++ head/security/vuxml/vuln.xml	Sun Jan 31 21:55:28 2021	(r563534)
@@ -77,6 +77,34 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="8ec7d426-055d-46bc-8f5a-a9d73a5a71ab">
+    <topic>minio -- Server Side Request Forgery</topic>
+    <affects>
+      <package>
+	<name>minio</name>
+	<range><lt>2021.01.30.00.20.58</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>Minio developers report:</p>
+	<blockquote cite="https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q">
+	  <p>Thanks to @phith0n from our community upon a code review, discovered an SSRF (Server Side Request Forgery) in our Browser API implementation. We have not observed this report/attack in the wild or reported elsewhere in the community at large.</p>
+	  <p>All users are advised to upgrade ASAP.</p>
+	  <p>The target application may have functionality for importing data from a URL, publishing data to a URL, or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.).</p>
+	  <p>In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like HTTP enabled databases, or perform post requests towards internal services which are not intended to be exposed.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://github.com/minio/minio/security/advisories/GHSA-m4qq-5f7c-693q</url>
+    </references>
+    <dates>
+      <discovery>2021-01-29</discovery>
+      <entry>2021-01-31</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="5d91370b-61fd-11eb-b87a-901b0ef719ab">
     <topic>FreeBSD -- Xen guests can triger backend Out Of Memory</topic>
     <affects>
