CVE-2018-1000538

Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling similar to CWE-774 vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-presigned requests with...

Denial Of Service (DoS)

github.com/minio/minio is vulnerable to denial of service DoS attacks. The application reads the entire body of a V4 request body into memory during checksum verification, allowing a malicious user to crash the application by sending a V4 request with a large body...

Denial Of Service (DoS)

github.com/minio/minio is vulnerable to denial of service DoS attacks. The application does not limit the request body size, allowing a malicious user to pass a request to the application to consume memory...

Authentication Bypass

github.com/minio/minio is vulnerable to authentication bypass attacks. The vulnerability exists as attackers can modify pre-signed signature V2 requests to make Admin-API calls...

Timing Attack

github.com/minio/minio is vulnerable to signature verification timing attacks. The vulnerability leaks information on the secret key by using an non constant time comparison method when verifying signatures...

Sweet32 Attack

github.com/minio/minio is vulnerable to the Sweet32 cryptography attack. The library uses a Triple-DES cipher that is vulnerable to birthday attacks, allowing a malicious user to decrypt and obtain cleartext data faster than a standard brute-force attack...

Replay Attack

github.com/minio/minio is vulnerable to replay attacks. The attacks exist because it does not verify the date and time from the headers of HTTP requests...

Denial Of Service (DoS)

github.com/minio/minio is vulnerable to denial of service DoS attacks. The library does not have a limit to the amount of data that is read when sent from a client. This allows a malicious user to send copious amounts of data to the system to cause a denial of service attack...