gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

minio: mark package as insecure

Browse Source 
Context: #490996
This commit is contained in:
Benedikt Ritter
2026-04-24 09:17:06 +02:00
parent e02e1158ce
commit e9d5e30aaf
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/by-name/mi/minio/package.nix
+9
View File
@@ -74,5 +74,14 @@ buildGoModule (finalAttrs: {
];
license = lib.licenses.agpl3Plus;
mainProgram = "minio";
knownVulnerabilities = [
"CVE-2026-40344: MinIO has an Unauthenticated Object Write via Missing Signature Verification in Unsigned-Trailer Uploads"
"CVE-2026-41145: Unauthenticated Object Write via Query-String Credential Signature Bypass in Unsigned-Trailer Uploads"
"CVE-2026-33322: JWT Algorithm Confusion in OIDC Authentication"
"CVE-2026-33419: LDAP login brute-force via user enumeration and missing rate limit"
"CVE-2026-34204: SSE Metadata Injection via Replication Headers"
"CVE-2026-39414: DoS via Unbounded Memory Allocation in S3 Select CSV Parsing"
"minio has been abandoned by upstream and security issues won't be fixed. Users should migrate to alternatives such as Garage, SeaweedFS, or Ceph. S3-compatible clients such as rclone can be used to move data."
];
};
})