RustFS で保持中のオブジェクトを含むバケットが強制削除される
Summary
RustFS 1.0.0 では、権限を持つユーザーが強制削除の指定を付けてバケットを削除すると、COMPLIANCE モードの保持期間中のオブジェクトを含むバケットも削除されてしまいます。影響を受けるのは RustFS 1.0.0 です。修正版の 1.0.2 以降へ更新してください。
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
RustFS 1.0.0 では、権限を持つユーザーが強制削除の指定を付けてバケットを削除すると、COMPLIANCE モードの保持期間中のオブジェクトを含むバケットも削除されてしまいます。影響を受けるのは RustFS 1.0.0 です。修正版の 1.0.2 以降へ更新してください。
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| rust | rustfs |
= 1.0.0 |
1.0.2 |
Original description The description as published by the source.
Summary
Summary
RustFS 1.0.0 allows an authorised force-delete caller, including the root/owner identity, to delete an Object-Lock-enabled bucket containing an object version under active COMPLIANCE retention.
Normal object-level Object Lock enforcement works correctly:
- deleting the retained version is denied;
BypassGovernanceRetentiondoes not bypass COMPLIANCE retention;- shortening the retention period is denied;
- changing the retention mode from COMPLIANCE to GOVERNANCE is denied;
- retention metadata and object bytes survive a RustFS restart.
However, sending DeleteBucket with:
x-rustfs-force-delete: true
### Details
## Summary
RustFS 1.0.0 allows an authorised force-delete caller, including the root/owner identity, to delete an Object-Lock-enabled bucket containing an object version under active COMPLIANCE retention.
Normal object-level Object Lock enforcement behaves correctly in the same test:
- deleting the retained version is denied;
- `BypassGovernanceRetention` does not bypass COMPLIANCE retention;
- shortening the COMPLIANCE retention period is denied;
- changing the retention mode from COMPLIANCE to GOVERNANCE is denied;
- retention metadata and the retained bytes survive a RustFS restart.
However, sending an authenticated `DeleteBucket` request containing:
```http
x-rustfs-force-delete: true
### Proof of concept
# Proof of concept
```markdown
> **Warning:** This proof of concept irreversibly deletes the test bucket. Run…
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY rustfs/rustfs