MinIO RELEASE.2024-12-13T22-19-12Zstable Released Dec 15, 2024
Impact Score: 5/10

MinIO: Security fix release

Source available โ€” automated, not human-reviewed

Component: minio ยท Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified โ€” check source notes
๐Ÿ“„ .MD
โšก Executive Summary (TL;DR)

MinIO RELEASE.2024-12-13T22-19-12Z. Source highlight: Privilege escalation bug fix

Who Does This Impact? (Role-Based Analysis)

๐Ÿ’ป Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

๐Ÿ“Š Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

โš™๏ธ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

โœจ New Features & Capabilities (4)

  • feat: bump github.com/cosnicolaou/pbzip2 from 1.0.3 to 1.0.5
  • Add the policy name to the audit logs tags when doing policy-based API calls. Add retention settings to tags
  • Add 'X-Forwarded-For' to (s)FTP requests
  • Adds AIstore documentation link

๐Ÿ”ง Bug Fixes & Patches (6)

  • Fix lint issues from v1.62.0 upgrade
  • heal/batch: Fix missing redirection to the first node
  • Fix 0 httpTimeout for logger webhook
  • Fixes api label casing and count value for +Inf bucket of prometheus MetricV2 histograms
  • fix: Remove User should fail for a service account
  • Fix prefix validation in lifecycle rule
๐Ÿ“„ View Raw Release Notes (Original Developer Log)
## Privilege escalation bug fix This release includes a fix for a privilege escalation vulnerability in the IAM import API (#20756). All users are advised to upgrade their deployments to this release. ## What's Changed * Fix lint issues from v1.62.0 upgrade by @klauspost in https://github.com/minio/minio/pull/20633 * Harden internode DeadlineConn by @klauspost in https://github.com/minio/minio/pull/20631 * Make DeadlineConn http.Listener compatible by @klauspost in https://github.com/minio/minio/pull/20635 * heal/batch: Fix missing redirection to the first node by @vadmeste in https://github.com/minio/minio/pull/20642 * updating all dependencies as per regular cadence by @harshavardhana in https://github.com/minio/minio/pull/20646 * Fix 0 httpTimeout for logger webhook by @dhananjaykrutika in https://github.com/minio/minio/pull/20653 * Keep larger merge buffers for RPC by @klauspost in https://github.com/minio/minio/pull/20654 * Fixes api label casing and count value for +Inf bucket of prometheus MetricV2 histograms by @john-morales in https://github.com/minio/minio/pull/20656 * feat: bump github.com/cosnicolaou/pbzip2 from 1.0.3 to 1.0.5 by @orisano in https://github.com/minio/minio/pull/20671 * fix: Remove User should fail for a service account by @donatello in https://github.com/minio/minio/pull/20677 * refactor: replace experimental `maps` and `slices` with stdlib by @Juneezee in https://github.com/minio/minio/pull/20679 * Add the policy name to the audit logs tags when doing policy-based API calls. Add retention settings to tags by @marktheunissen in https://github.com/minio/minio/pull/20638 * Fix prefix validation in lifecycle rule by @dhananjaykrutika in https://github.com/minio/minio/pull/20684 * heal: Better reporting to mc with dangling/timeout errors by @vadmeste in https://github.com/minio/minio/pull/20690 * Add a test case for fix #20684 by @dhananjaykrutika in https://github.com/minio/minio/pull/20688 * prevent IAM cleanup errors by @ramondeklein in https://github.com/minio/minio/pull/20691 * Updated Console to v1.7.4 by @bexsoft in https://github.com/minio/minio/pull/20693 * Add 'X-Forwarded-For' to (s)FTP requests by @klauspost in https://github.com/minio/minio/pull/20709 * Set http server read/write timeout from --idle-timeout (#228) by @vadmeste in https://github.com/minio/minio/pull/20715 * heal: Single object heal to look for older versions as well (#203) by @vadmeste in https://github.com/minio/minio/pull/20723 * heal: Report bucket healing result correctly by @vadmeste in https://github.com/minio/minio/pull/20721 * Return error when attempting to create a policy with commas in name by @taran-p in https://github.com/minio/minio/pull/20724 * Disable mint full object tests by @klauspost in https://github.com/minio/minio/pull/20743 * Fixes for POST policy checks and the x-ignore implementation by @marktheunissen in https://github.com/minio/minio/pull/20674 * Adds AIstore documentation link by @ebozduman in https://github.com/minio/minio/pull/20738 * fix: groups lookup performance issue with users with lots of groups by @harshavardhana in https://github.com/minio/minio/pull/20740 * Upgrade Console version to v1.7.5 by @cesnietor in https://github.com/minio/minio/pull/20748 * fix: Privilege escalation in IAM import API by @donatello in https://github.com/minio/minio/pull/20756 * heal: Move CheckParts from single handler to streaming RPC by @vadmeste in https://github.com/minio/minio/pull/20755 * Bump golang.org/x/crypto from 0.23.0 to 0.31.0 in /docs/debugging/s3-verify by @dependabot in https://github.com/minio/minio/pull/20757 * fix: replace mutex with atomic by @arturmelanchyk in https://github.com/minio/minio/pull/20762 * fix: specify size in make by @arturmelanchyk in https://github.com/minio/minio/pull/20764 ## New Contributors * @dhananjaykrutika made their first contribution in https://github.com/minio/minio/pull/20653 * @john-morales made their first contribution in https://github.com/minio/minio/pull/20656 * @orisano made their first contribution in https://github.com/minio/minio/pull/20671 * @arturmelanchyk made their first contribution in https://github.com/minio/minio/pull/20762 **Full Changelog**: https://github.com/minio/minio/compare/RELEASE.2024-11-07T00-52-20Z...RELEASE.2024-12-13T22-19-12Z