CVE-2018-1000538: High severity minio vulnerability

Q: What is the severity of CVE-2018-1000538?

CVE-2018-1000538 has a high severity rating due to its potential to cause a Denial of Service.

Q: How do I fix CVE-2018-1000538?

To fix CVE-2018-1000538, upgrade to MinIO server version RELEASE.2018-05-16T23-35-33Z or later.

Q: What type of vulnerability is CVE-2018-1000538?

CVE-2018-1000538 is classified as an Allocation of Memory Without Limits or Throttling vulnerability.

Q: What impact does CVE-2018-1000538 have on my MinIO server?

CVE-2018-1000538 can lead to Denial of Service, affecting the availability of your MinIO server.

Q: Can CVE-2018-1000538 be exploited remotely?

Yes, CVE-2018-1000538 can be exploited remotely by sending V4-(pre)signed requests.

Published Jun 26, 2018

Updated

Minio Inc. Minio S3 server version prior to RELEASE.2018-05-16T23-35-33Z contains a Allocation of Memory Without Limits or Throttling (similar to CWE-774) vulnerability in write-to-RAM that can result in Denial of Service. This attack appear to be exploitable via Sending V4-(pre)signed requests with large bodies . This vulnerability appears to have been fixed in after commit 9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7.

Affected Software

1 affected component

MinIO<2018-05-16t23-35-33z

Remediation

Patch Available

https://github.com/minio/minio/commit/9c8b7306f55f2c8c0a5c7cea9a8db9d34be8faa7#diff-e8c3bc9bc83b5516d0cc806cd461d08bL220

Event History

Jun 26, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1000538?

CVE-2018-1000538 has a high severity rating due to its potential to cause a Denial of Service.

How do I fix CVE-2018-1000538?

To fix CVE-2018-1000538, upgrade to MinIO server version RELEASE.2018-05-16T23-35-33Z or later.

What type of vulnerability is CVE-2018-1000538?