minio/pkg
Andreas Auernhammer 9c8b7306f5 security: fix write-to-RAM DoS vulnerability (#5957)
This commit fixes a DoS vulnerability for certain APIs using
signature V4 by verifying the content-md5 and/or content-sha56 of
the request body in a streaming mode.

The issue was caused by reading the entire body of the request into
memory to verify the content-md5 or content-sha56 checksum if present.

The vulnerability could be exploited by either replaying a V4 request
(in the 15 min time frame) or sending a V4 presigned request with a
large body.
2018-05-18 11:27:25 -07:00
..
auth Remove panic() and handle it appropriately (#5807) 2018-04-19 17:24:43 -07:00
bpool Add large bucket support for erasure coded backend (#5160) 2018-02-15 17:45:57 -08:00
cgroup sys/stats: return cgroup mem limit, fall back to sysinfo() (#4002) 2017-04-02 10:46:16 -07:00
disk Add GetInfo() support for solaris (#5174) 2017-11-13 12:54:38 -08:00
ellipses Add large bucket support for erasure coded backend (#5160) 2018-02-15 17:45:57 -08:00
event fix: Avoid more crashes due to concurrent map usage (#5912) 2018-05-09 15:11:51 -07:00
handlers Remove all unused variables and functions (#5823) 2018-04-15 19:26:04 +05:30
hash security: fix write-to-RAM DoS vulnerability (#5957) 2018-05-18 11:27:25 -07:00
ioutil Support SSE-C multipart source objects in CopyObject (#5603) 2018-03-02 17:24:02 -08:00
lock Lock free multipart backend implementation for FS (#5401) 2018-01-31 13:17:24 -08:00
madmin Fix docs in admin API (#5559) 2018-02-21 12:00:46 -08:00
mimedb cleanup: All conditionals simplified under pkg. (#3875) 2017-03-09 10:13:30 -08:00
mountinfo Fail to start server if detected cross-device mounts. (#4807) 2017-08-15 15:10:50 -07:00
net Remove panic() and handle it appropriately (#5807) 2018-04-19 17:24:43 -07:00
policy fix: export policy.Resource for remote RPC policy updates (#5941) 2018-05-16 16:17:00 -07:00
quick Generalize loadConfig method to avoid reading from disk (#5819) 2018-04-13 15:14:19 -07:00
safe Remove go1.9 specific code for windows (#5033) 2017-10-13 15:31:15 +05:30
sync/errgroup Add large bucket support for erasure coded backend (#5160) 2018-02-15 17:45:57 -08:00
sys Push max threads to little less than kernel limit (#5001) 2017-10-03 10:37:45 -07:00
trie trie: new package (#3729) 2017-02-10 11:51:41 -08:00
wildcard pkg/wildcard: Simplify the wildcard logic further. (#2555) 2016-08-27 00:27:17 -07:00
words words: new package Damerau Levenshtein distance function. (#3929) 2017-03-19 14:23:05 -07:00