Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2023-28432 #1667

Closed
GoVulnBot opened this issue Mar 22, 2023 · 3 comments
Closed

x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2023-28432 #1667

GoVulnBot opened this issue Mar 22, 2023 · 3 comments
Assignees
@julieqiu
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

CVE-2023-28432 references github.com/minio/minio, which may be a Go module.

Description:
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIO_SECRET_KEY and MINIO_ROOT_PASSWORD, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/minio/minio
    packages:
      - package: minio
description: |
    Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, resulting in information disclosure. All users of distributed deployment are impacted. All users are advised to upgrade to RELEASE.2023-03-20T20-16-18Z.
cves:
  - CVE-2023-28432
references:
  - advisory: https://github.com/minio/minio/security/advisories/GHSA-6xvq-wj2x-3h3q
  - web: https://github.com/minio/minio/releases/tag/RELEASE.2023-03-20T20-16-18Z
@julieqiu julieqiu added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Mar 23, 2023
@julieqiu julieqiu self-assigned this Mar 23, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/478875 mentions this issue: data/excluded: batch add excluded reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/479297 mentions this issue: data/excluded: batch add GO-2023-1674, GO-2023-1671, GO-2023-1670, GO-2023-1669, GO-2023-1668, GO-2023-1667, GO-2023-1662, GO-2023-1661, GO-2023-1660, GO-2023-1659, GO-2023-1658, GO-2023-1657, GO-2023-1656, GO-2023-1655, GO-2023-1654, GO-2023-1653, GO-2023-1673, GO-2023-1666, GO-2023-1665

This was referenced Nov 8, 2023
Closed
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Feb 1, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue May 28, 2024
Closed
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592760 mentions this issue: data/reports: unexclude 75 reports

@GoVulnBot GoVulnBot mentioned this issue Dec 16, 2024
Closed
This was referenced Dec 23, 2024
Closed
Closed
Closed
@GoVulnBot GoVulnBot mentioned this issue Feb 28, 2025
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@julieqiu julieqiu

Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@julieqiu @gopherbot @GoVulnBot