https://silo.pgsty.com/tags/governance/ Recent content in Governance on SILO Hugo en Sat, 24 Oct 2026 18:19:49 +0800 https://silo.pgsty.com/blog/security/20260926-governance-retention-bypass/ Sat, 26 Sep 2026 00:00:00 +0000 https://silo.pgsty.com/blog/security/20260926-governance-retention-bypass/ <p><strong><code>SN-2026-015</code></strong> and <strong><code>SN-2026-016</code></strong> cover two S3 Object Lock retention and immutability vulnerabilities fixed in <a href="https://silo.pgsty.com/blog/release/silo-20261018/">SILO Server 20261018</a> via PR <a href="https://github.com/pgsty/silo/pull/234"><code>#234</code></a> (<code>14042b5aa</code>) and PR <a href="https://github.com/pgsty/silo/pull/235"><code>#235</code></a> (<code>0d3ba5d4c</code>), as detailed in the companion <a href="https://silo.pgsty.com/blog/design/governance-retention-bypass-repair/">repair design note</a>. While the delete path already enforced <code>s3:BypassGovernanceRetention</code> (<a href="https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63">CVE-2023-25812</a>), the retention-write path (<code>PutObjectRetention</code>) and four in-place version overwrite paths remained bypassable.</p> <h2 id="advisory-scope-sn-2026-015-and-sn-2026-016">Advisory Scope: <code>SN-2026-015</code> and <code>SN-2026-016</code> </h2> <h3 id="sn-2026-015">SN-2026-015: <code>PutObjectRetention</code> Authorization and Governance Bypass (<code>#231</code>) </h3> <p>In <code>PutObjectRetentionHandler</code> (<code>cmd/object-handlers.go</code>), three interacting flaws in <code>enforceRetentionBypassForPut</code> and <code>isPutRetentionAllowed</code> broke S3 Object Lock authorization:</p>