MinIO is a multi-cloud object storage solution. Starting with version RELEASE.2019-09-25T18-25-51Z and ending with version RELEASE.2022-06-02T02-11-04Z, MinIO is vulnerable to an unending go-routine buildup while keeping connections established due to HTTP clients not closing the connections. Public-facing MinIO deployments are most affected. Users should upgrade to RELEASE.2022-06-02T02-11-04Z to receive a patch. One possible workaround is to use a reverse proxy to limit the number of connections being attempted in front of MinIO, and actively rejecting connections from such malicious clients.
References
Link | Resource |
---|---|
https://gist.github.com/harshavardhana/2d00e6f909054d2d2524c71485ad02e1 | Exploit Third Party Advisory |
https://github.com/minio/minio/pull/14995 | Patch Third Party Advisory |
https://github.com/minio/minio/releases/tag/RELEASE.2022-06-03T01-40-53Z | Third Party Advisory |
https://github.com/minio/minio/security/advisories/GHSA-qrpr-r3pw-f636 | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-06-03T14:40:11
Updated: 2022-06-03T14:40:11
Reserved: 2022-05-18T00:00:00
Link: CVE-2022-31028
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-06-07T16:15:07.760
Modified: 2022-06-14T14:40:02.617
Link: CVE-2022-31028
JSON object: View
Redhat Information
No data.
CWE