Andreas Auernhammer 9c8b7306f5 security: fix write-to-RAM DoS vulnerability (#5957) ... This commit fixes a DoS vulnerability for certain APIs using signature V4 by verifying the content-md5 and/or content-sha56 of the request body in a streaming mode. The issue was caused by reading the entire body of the request into memory to verify the content-md5 or content-sha56 checksum if present. The vulnerability could be exploited by either replaying a V4 request (in the 15 min time frame) or sending a V4 presigned request with a large body.		2018-05-18 11:27:25 -07:00
..
auth	Remove panic() and handle it appropriately (#5807)	2018-04-19 17:24:43 -07:00
bpool	Add large bucket support for erasure coded backend (#5160)	2018-02-15 17:45:57 -08:00
cgroup	sys/stats: return cgroup mem limit, fall back to sysinfo() (#4002)	2017-04-02 10:46:16 -07:00
disk	Add GetInfo() support for solaris (#5174)	2017-11-13 12:54:38 -08:00
ellipses	Add large bucket support for erasure coded backend (#5160)	2018-02-15 17:45:57 -08:00
event	fix: Avoid more crashes due to concurrent map usage (#5912)	2018-05-09 15:11:51 -07:00
handlers	Remove all unused variables and functions (#5823)	2018-04-15 19:26:04 +05:30
hash	security: fix write-to-RAM DoS vulnerability (#5957)	2018-05-18 11:27:25 -07:00
ioutil	Support SSE-C multipart source objects in CopyObject (#5603)	2018-03-02 17:24:02 -08:00
lock	Lock free multipart backend implementation for FS (#5401)	2018-01-31 13:17:24 -08:00
madmin	Fix docs in admin API (#5559)	2018-02-21 12:00:46 -08:00
mimedb	cleanup: All conditionals simplified under pkg. (#3875)	2017-03-09 10:13:30 -08:00
mountinfo	Fail to start server if detected cross-device mounts. (#4807)	2017-08-15 15:10:50 -07:00
net	Remove panic() and handle it appropriately (#5807)	2018-04-19 17:24:43 -07:00
policy	fix: export policy.Resource for remote RPC policy updates (#5941)	2018-05-16 16:17:00 -07:00
quick	Generalize loadConfig method to avoid reading from disk (#5819)	2018-04-13 15:14:19 -07:00
safe	Remove go1.9 specific code for windows (#5033)	2017-10-13 15:31:15 +05:30
sync/errgroup	Add large bucket support for erasure coded backend (#5160)	2018-02-15 17:45:57 -08:00
sys	Push max threads to little less than kernel limit (#5001)	2017-10-03 10:37:45 -07:00
trie	trie: new package (#3729)	2017-02-10 11:51:41 -08:00
wildcard	pkg/wildcard: Simplify the wildcard logic further. (#2555)	2016-08-27 00:27:17 -07:00
words	words: new package Damerau Levenshtein distance function. (#3929)	2017-03-19 14:23:05 -07:00