CVE-2021-21390

Katalog CVE

CVSS 5.9 · Medium EPSS 0,85%

Kerentanan Improper Enforcement of Message Integrity During Transmission in a Communication Channel pada minio. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature. This is fixed in version RELEASE.2021-03-17T02-33-02Z. As a workaround one can avoid using "aws-chunked" encoding-based chunk signature upload requests instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS.

Rincian

Terbit di NVD

19 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

EPSS (30 hari)

0,85% peluang dieksploitasi; lebih tinggi dari 57,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/minio/minio/commit/e197800f9055489415b53cf137e31e194aaf7ba0 exploit · patch · advisory pihak ketiga
• https://github.com/minio/minio/pull/11801 exploit · patch · advisory pihak ketiga
• https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp exploit · patch · advisory pihak ketiga