Huawei EulerOS: Security Advisory for ceph-common (EulerOS-SA-2021-2897)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

REST API Error: S3 Error: The difference between the request time and the current time is too large / Invalid Credentials for Amazon S3

Challenge This article covers two different errors that occur when performing different tasks, but have the same root cause: When adding S3 Object Storage to Veeam Console, Veeam displays the follow error: Failed to list S3 buckets: check if the specified account has required permissions REST API...

Fedora: Security Advisory for python-boto3 (FEDORA-2021-f916f64e5e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 35 Update: python-boto3-1.19.7-1.fc35

Boto3 is the Amazon Web Services AWS Software Development Kit SDK for Python, which allows Python developers to write software that makes use of services like Amazon S3 and Amazon EC2...

EulerOS 2.0 SP5 : ceph-common (EulerOS-SA-2021-2322)

According to the version of the ceph-common packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potenti...

5 #TrendTips For Better File Storage Security

Here are 5 TrendTips to secure valuable files and objects stored in the cloud via services like Amazon S3...

How to improve security for Amazon S3 buckets

Avoid post-deployment headaches by increasing the security of your Amazon S3 buckets and the objects stored within during the early phases of development...

OESA-2021-1145 rubygem-rails security update

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration. Security Fixes: A deserialization of untrusted data vulnernerability exists in rails 5.2.4.3, rails 6.0.3.1 that can...

CVE-2021-21390

MinIO (open-source object storage) contains a PUT-mode vulnerability in aws-chunked encoding where the server may skip end-of-chunk signature verification if a forged chunk size is sent, enabling MITM modification of request bodies intended to be protected by chunk signatures. This affects releas...

COVID-19 testing service in US exposes patients’ photos, passports

By Habiba Rashid COVID-19 testing service in the State of Utah stored passport scans and other highly personal data on unsecured Amazon S3 buckets. This is a post from HackRead.com Read the original post: COVID-19 testing service in US exposes patients photos, passports...

CVE-2021-21362

MinIO vuln CVE-2021-21362 affects MinIO before RELEASE.2021-03-04T00-53-13Z. A remote attacker could bypass a readOnly policy by creating a temporary 'mc share upload' URL, enabling modification of a resource in multi-user deployments. The issue is fixed in RELEASE.2021-03-04T00-53-13Z. Workaroun...

How to Configure and Secure Amazon S3

In this article, we’ll dive into some of the workarounds and considerations you may encounter with Amazon S3, since it’s the most used—and misused—cloud storage option on AWS...

TikTok: Subdomain Takeover via Unclaimed Amazon S3 Bucket (Musical.ly)

An unclaimed Amazon S3 bucket which no longer used for any TikTok applications and did not host any user data could have allowed a takeover on a musical.ly subdomain. We thank @daik0n for reporting this to our team...

Shopify: [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image

Hello Shopify, when testing Shopify Ping share image function, I discovered an Amazon S3 bucket which has public access which allows an attacker to view all the image of other merchant & users. Steps To Reproduce: 1. Install Shopify Ping on your phone then enable Shopify Chat for your store. 2. G...

PT-2020-20364

Name of the Vulnerable Software and Affected Versions AWS S3 Crypto SDK for GoLang versions prior to V2 Description A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang, allowing an attacker with write access to the target's S3 bucket and the ability to observe decryption...

U.S. Dept Of Defense: Subdomain takeover due to an unclaimed Amazon S3 bucket on ███

Summary: An unclaimed Amazon S3 bucket on █████████ gives an attacker the possibility to gain full control over this subdomain. Description: ███████ pointed to an S3 bucket that did no longer exists. The bucket points to an Amazon S3 website bucket in the US East region. I claimed this bucket and...

Error "Failed to establish connection to Amazon S3 endpoint" or "Azure Cloud connection has returned an untrusted certificate."

Challenge When attempting to add an Object Storage Repository or use an existing Object Storage Repository the following errors occur: Connection to Amazon S3 object storage fails with the following error: Failed to load Amazon S3 Compatible configuration: Failed to establish connection to Amazon...

Is Cloud Computing Any Safer From Malicious Hackers?

Cloud computing has revolutionized the IT world, making it easier for companies to deploy infrastructure and applications and deliver their services to the public. The idea of not spending millions of dollars on equipment and facilities to host an on-premises data center is a very attractive...

S3BucketList - Firefox Plugin The Lists Amazon S3 Buckets Found In Requests

S3BucketList is a Firefox plugin that records S3 Buckets found in requests. It is currently a work in progress and additional features will be added in the future. This plugin will also be ported to other browsers in the future. Stay tuned! Installation This plugin is already available in Firefox...

CVE-2020-1760

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input...