Virtuozzo Hybrid Infrastructure 5.4 (5.4.0-133)

In this release, Virtuozzo Hybrid Infrastructure provides a range of new features that cover compute services, management node high availability, monitoring and alerts, and the user interface. Additionally, this release delivers stability improvements and addresses issues found in previous...

lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. Patches lakeFS v0.82.0 and later Workarounds Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts wi...

GHSA-28Q9-9C3G-V3F9 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. Patches lakeFS v0.82.0 and later Workarounds Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts wi...

Improper Access Control

github.com/treeverse/lakefs is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient user permission checks on repository actions, allowing an attacker to use the S3 gateway to copy object and read write actions on repository commits...

GHSA-M836-GXWQ-J2PM Improper Access Control in github.com/treeverse/lakefs

Impact 1. medium A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name. 1. medium A user with permission to write any one of tags, branches, or commits on a repository may write all of them. 1. low A user with...

Virtuozzo Hybrid Infrastructure 4.7

In this release, Virtuozzo Hybrid Infrastructure provides a wide range of new features that enhance service providers' interoperability and help expand their services. The improvements cover compute services, object storage, core storage, monitoring, high availability for the management node,...

CVE-2020-17517 Ozone S3 Gateway allows bucket and key access to non authenticated users

The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereb...