x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2023-25812

[GoVulnBot]

CVE-2023-25812 references github.com/minio/minio, which may be a Go module.

Description:
Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a Deny policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header X-Amz-Bypass-Governance-Retention: true. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-25812
• JSON: https://github.com/CVEProject/cvelist/tree/a3a2217d615b654e3c77ca8f032a08fcc298ca52/2023/25xxx/CVE-2023-25812.json
• advisory: GHSA-c8fc-mjj8-fc63
• fix: fix: evaluate BypassGov policy action in deletion correctly minio/minio#16635
• fix: minio/minio@a7188bc
• Imported by: https://pkg.go.dev/github.com/minio/minio?tab=importedby

Cross references:

• Module github.com/minio/minio appears in issue x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2021-43858 #285 EFFECTIVELY_PRIVATE
• Module github.com/minio/minio appears in issue x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2022-24842 #421 EFFECTIVELY_PRIVATE
• Module github.com/minio/minio appears in issue x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2022-31028 #479 EFFECTIVELY_PRIVATE
• Module github.com/minio/minio appears in issue x/vulndb: potential Go vuln in github.com/minio/minio: CVE-2022-35919 #756 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/minio/minio
    packages:
      - package: minio
description: |
    Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId with the special header `X-Amz-Bypass-Governance-Retention: true`. However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted. All users are advised to upgrade. There are no known workarounds for this issue.
cves:
  - CVE-2023-25812
references:
  - advisory: https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63
  - fix: https://github.com/minio/minio/pull/16635
  - fix: https://github.com/minio/minio/commit/a7188bc9d0f0a5ae05aaf1b8126bcd3cb3fdc485

[gopherbot]

Change https://go.dev/cl/471796 mentions this issue: data/excluded: batch add excluded reports

[gopherbot]

Change https://go.dev/cl/592759 mentions this issue: data/reports: unexclude 75 reports