Description
IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed without validating bucket ownership using the ExpectedBucketOwner parameter. This omission may allow a remote attacker to exploit misconfigurations or naming collisions to redirect application requests to an unintended S3 bucket under their control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Netezza Software | 11.3.0.3 – ≤ Interim Fix 002 | — |
References
- https://www.ibm.com/support/pages/node/7284359 vendor-advisory patch