PkgSeer

Vulnerability GO-2025-3495

Unknown

1 year ago

MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio

>=0.0.0

Summary

MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio

Details

MinIO SFTP authentication bypass due to improperly trusted SSH key in github.com/minio/minio.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/minio/minio from RELEASE.2024-06-06T09-36-42Z before RELEASE.2025-02-28T09-55-16Z.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

>=0.0.0 GO-2026-5757

MinIO affected a DoS via Unbounded Memory Allocation in S3 Select CSV Parsing in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5415

MinIO has an Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5437

MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads in github.com/minio/minio

v0.0.0-20260212201848-7aac2a2c5b7c GO-2026-5284

MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint

>=0.0.0-20220724015452 <0.0.0-20260414213245 GHSA-xh8f-g2qw-gcm7

View all vulnerabilities for these packages

Impacted packages

github.com/minio/minio

Timeline

Published

1 year ago

Last Modified

2 hours ago