Nick Craig-Wood a16a901de7 serve s3: stop auth proxy users using each other's multipart uploads and metadata GHSA-35g6-9fjv-rmx5 CVE-PENDING ...

With --auth-proxy each access key ID may be mapped to a different
backend, but serve s3 found a streaming multipart upload by its upload
ID alone and stored object metadata by path alone.

A user who learnt another user's upload ID (for example from
ListMultipartUploads on a bucket of the same name) could upload parts
to, complete or abort that upload on the other user's backend. A user
with an object at the same bucket and key as another user was returned
the other user's metadata by HeadObject and GetObject and could
overwrite it.

Keep the uploads and metadata of each access key ID apart.

2026-10-08 22:49:33 +01:00

..

proxy_code.go

serve s3: stop auth proxy users using each other's multipart uploads and metadata GHSA-35g6-9fjv-rmx5 CVE-PENDING

2026-10-08 22:49:33 +01:00

rc.go

serve, mountlib: test VFS release on shutdown and mount failure

2026-08-18 09:03:12 +01:00

servetest.go

servetest: add RunWithBackend so serve tests can pick a non-local backing

2026-06-11 12:30:19 +01:00