CVE-2021-21390

    Dashboard / Vulnerabilities / CVE-2021-21390

    CVE-2021-21390

    Published: 19 Mar 2021Last Modified: 9 Jul 2026

    Summary:

    Details: MinIO is an open-source high performance object storage service and it is API compatible with Amazon S3 cloud storage service. In MinIO before version RELEASE.2021-03-17T02-33-02Z, there is a vulnerability which enables MITM modification of request bodies that are meant to have integrity guaranteed by chunk signatures. In a PUT request using aws-chunked encoding, MinIO ordinarily verifies signatures at the end of a chunk. This check can be skipped if the client sends a false chunk size that is much greater than the actual data sent: the server accepts and completes the request without ever reaching the end of the chunk + thereby without ever checking the chunk signature. This is fixed in version RELEASE.2021-03-17T02-33-02Z. As a workaround one can avoid using "aws-chunked" encoding-based chunk signature upload requests instead use TLS. MinIO SDKs automatically disable chunked encoding signature when the server endpoint is configured with TLS.

    References: https://github.com/minio/minio/commit/e197800f9055489415b53cf137e31e194aaf7ba0, https://github.com/minio/minio/pull/11801, https://github.com/minio/minio/security/advisories/GHSA-xr7r-7gpj-5pgp

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e197800f9055489415b53cf137e31e194aaf7ba0

    Affected versions

    RELEASE.2021-03-12T00-00-47Z

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-21390 | CVE-DB