CVE-2024-55949 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-55949 Interim 1 10 2026-03-05T01:45:41Z current 2024-12-20T00:11:12Z 2026-03-05T01:45:41Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-55949 MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GN5BTYONDVDULOG3YURKUJNL2YZ2LDHU/ E-Mail link for openSUSE-SU-2024:14603-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed cloud-netconfig-azure-1.15-slfo.1.1_1.1 cloud-netconfig-ec2-1.15-slfo.1.1_1.1 cloud-netconfig-gce-1.15-slfo.1.1_1.1 govulncheck-vulndb-0.0.20241218T202206-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 less-633-3.1 less-633-3.1 as a component of Container suse/sl-micro/6.0/baremetal-os-container:latest less-633-3.1 as a component of Container suse/sl-micro/6.0/toolbox:latest less-633-3.1 as a component of Image SL-Micro less-633-3.1 as a component of Image SL-Micro-Base less-633-3.1 as a component of Image SL-Micro-Base-RT less-633-3.1 as a component of Image SL-Micro-Base-RT-SelfInstall less-633-3.1 as a component of Image SL-Micro-Base-RT-encrypted less-633-3.1 as a component of Image SL-Micro-Base-SelfInstall less-633-3.1 as a component of Image SL-Micro-Base-encrypted less-633-3.1 as a component of Image SL-Micro-Base-qcow less-633-3.1 as a component of Image SL-Micro-Default less-633-3.1 as a component of Image SL-Micro-Default-SelfInstall less-633-3.1 as a component of Image SL-Micro-Default-encrypted less-633-3.1 as a component of Image SL-Micro-Default-qcow cloud-netconfig-ec2-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro less-633-3.1 as a component of Image SLE-Micro cloud-netconfig-azure-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-Azure less-633-3.1 as a component of Image SLE-Micro-Azure cloud-netconfig-ec2-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS less-633-3.1 as a component of Image SLE-Micro-BYOS cloud-netconfig-azure-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-Azure less-633-3.1 as a component of Image SLE-Micro-BYOS-Azure cloud-netconfig-ec2-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-EC2 less-633-3.1 as a component of Image SLE-Micro-BYOS-EC2 cloud-netconfig-gce-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-BYOS-GCE less-633-3.1 as a component of Image SLE-Micro-BYOS-GCE cloud-netconfig-ec2-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 less-633-3.1 as a component of Image SLE-Micro-EC2 cloud-netconfig-gce-1.15-slfo.1.1_1.1 as a component of Image SLE-Micro-GCE less-633-3.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20241218T202206-1.1 as a component of openSUSE Tumbleweed MinIO is a high-performance, S3 compatible object store, open sourced under GNU AGPLv3 license. Minio is subject to a privilege escalation in IAM import API, all users are impacted since MinIO commit `580d9db85e04f1b63cc2909af50f0ed08afa965f`. This issue has been addressed in commit `f246c9053f9603e610d98439799bdd2a6b293427` which is included in RELEASE.2024-12-13T22-19-12Z. There are no workarounds possible, all users are advised to upgrade immediately. CVE-2024-55949 Container suse/sl-micro/6.0/baremetal-os-container:latest:less-633-3.1 Container suse/sl-micro/6.0/toolbox:latest:less-633-3.1 Image SL-Micro:less-633-3.1 Image SL-Micro-Base:less-633-3.1 Image SL-Micro-Base-RT:less-633-3.1 Image SL-Micro-Base-RT-SelfInstall:less-633-3.1 Image SL-Micro-Base-RT-encrypted:less-633-3.1 Image SL-Micro-Base-SelfInstall:less-633-3.1 Image SL-Micro-Base-VMware:less-633-3.1 Image SL-Micro-Base-encrypted:less-633-3.1 Image SL-Micro-Base-qcow:less-633-3.1 Image SL-Micro-Default:less-633-3.1 Image SL-Micro-Default-SelfInstall:less-633-3.1 Image SL-Micro-Default-VMware:less-633-3.1 Image SL-Micro-Default-encrypted:less-633-3.1 Image SL-Micro-Default-qcow:less-633-3.1 Image SLE-Micro:cloud-netconfig-ec2-1.15-slfo.1.1_1.1 Image SLE-Micro:less-633-3.1 Image SLE-Micro-Azure:cloud-netconfig-azure-1.15-slfo.1.1_1.1 Image SLE-Micro-Azure:less-633-3.1 Image SLE-Micro-BYOS:cloud-netconfig-ec2-1.15-slfo.1.1_1.1 Image SLE-Micro-BYOS:less-633-3.1 Image SLE-Micro-BYOS-Azure:cloud-netconfig-azure-1.15-slfo.1.1_1.1 Image SLE-Micro-BYOS-Azure:less-633-3.1 Image SLE-Micro-BYOS-EC2:cloud-netconfig-ec2-1.15-slfo.1.1_1.1 Image SLE-Micro-BYOS-EC2:less-633-3.1 Image SLE-Micro-BYOS-GCE:cloud-netconfig-gce-1.15-slfo.1.1_1.1 Image SLE-Micro-BYOS-GCE:less-633-3.1 Image SLE-Micro-EC2:cloud-netconfig-ec2-1.15-slfo.1.1_1.1 Image SLE-Micro-EC2:less-633-3.1 Image SLE-Micro-GCE:cloud-netconfig-gce-1.15-slfo.1.1_1.1 Image SLE-Micro-GCE:less-633-3.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20241218T202206-1.1 critical