Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Unicode RIGHT-TO-LEFT OVERRIDE characters can be used to mask the original filename. Reported-By Thanks to the report from Mio Li wulilixi1@gmail.com Patches Workarounds Workarounds are to remove the concerned file and rewrite it properly with the right file and extensions. Avoid using RTLO characters in your filenames.
Recommended action: Upgrade to 0.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
During an internal security audit, we detected an authentication bypass issue in the Operator Console when an external IDP is enabled. The security issue has been reported internally. We have not observed this exploit in the wild or reported elsewhere in the community at large. All users are advised to upgrade ASAP. Impact All users on release v0.12.2 and before are affected. Patches This issue was fixed by PR https://github.com/minio/console/pull/1217, users should upgrade to latest release. Workarounds Add automountServiceAccountToken: false to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the CONSOLEIDPURL, CONSOLEIDPCLIENTID, CONSOLEIDPSECRET and CONSOLEIDPCALLBACK environment variable and instead use the Kubernetes service account token. References #1217 for more information on the fix and how it was fixed. For more information If you have any…
Recommended action: Upgrade to 0.12.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.