CVE-2024-45106

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...

CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...

CVE-2024-45106

CVE-2024-45106 describes an authentication flaw in the S3 Gateway of Apache Ozone 1.4.0 , where an authenticated Kerberos user can revoke and regenerate another user’s S3 secrets if: ozone.s3g.secret.http.enabled is true (default is false) the Kerberos principal is listed in ozone.s3.administrato...

CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...

CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...

How to Update Location Profile Endpoint Details and Preserve Access to an Existing Kopia Storage Repository

Purpose This article documents the correct procedure to update the Endpoint details in the Location Profile for an existing Kopia storage repository in S3-compatible stores and ensure the existing associated repositories remain accessible. Customers may wish to update the Endpoint details e.g.,...

PT-2024-31436 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone version 1.4.0 Description: The issue is related to improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone. This allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other...

Data broker exposes 600,000 sensitive files including background checks

A researcher has discovered a data broker had stored 644,869 PDF files in a publicly accessible cloud storage container. The 713.1 GB container an Amazon S3 bucket did not have password-protection, and the data was left unencrypted, so anybody who stumbled on them could read the files. The files...

Security update for ovmf

This update for ovmf fixes the following issues: CVE-2024-1298: Fixed potential UINT32 overflow in S3 ResumeCount bsc1225889. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

OESA-2024-2434 python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...

OESA-2024-2432 python-requests security update

Requests is an HTTP library, written in Python, as an alternative to Python's builtin urllib2 which requires work even method overrides to perform basic tasks. Features of Requests: - GET, HEAD, POST, PUT, DELETE Requests: + HTTP Header Request Attachment. + Data/Params Request Attachment. +...

CVE-2024-1682

A flaw was found in the psf/requests documentation. This vulnerability allows data integrity issues, data leakage, availability problems, and potential further attacks via a reference to an unclaimed Amazon S3 bucket in an audio file link within a .rst documentation file. Mitigation Mitigation fo...

Virtuozzo Hybrid Infrastructure 6.3 Hotfix 1 (6.3.0-177)

This update provides stability and performance improvements. Vulnerability id: VSTOR-91833 A performance improvement. Vulnerability id: VSTOR-94382 Increased the number of Grafana dashboards that can be added to the Dashboard Directory. Vulnerability id: VSTOR-94508 In the admin panel, LUNs are n...

CVE-2024-1682

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of...

CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of...

CVE-2024-1682

CVE-2024-1682 concerns an unclaimed Amazon S3 bucket named 'codeconf' referenced in an audio-file link in .rst docs. Connected sources confirm this bucket has been claimed and discuss potential data integrity, leakage, availability, trust, and pivot risks if used to host or relay malicious conten...

CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of...

CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation

An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been claimed by an external party. The use of this unclaimed S3 bucket could lead to data integrity issues, data leakage, availability problems, loss of...

Virtuozzo Hybrid Infrastructure 6.1 Update 1 Hotfix 8 (6.1.1-61)

This update provides stability fixes. Vulnerability id: VSTOR-90793 Volume resize fails when the Nova API is not upgraded. Vulnerability id: VSTOR-94387 A stability fix for the S3 service. Vulnerability id: VSTOR-94519 When a VM is shelved by a host evacuation task, its attached PCI devices are n...

Virtuozzo Hybrid Infrastructure 6.2 Update 1 Hotfix 3 (6.2.1-68)

This update provides stability fixes. Vulnerability id: VSTOR-94508 In the admin panel, LUNs are not displayed for a new target group. Vulnerability id: VSTOR-94519 When a VM is shelved by a host evacuation task, its attached PCI devices are not released. Vulnerability id: VSTOR-94551 Failed to...