https://silo.pgsty.com/tags/source-address/Recent content in Source Address on SILOHugoenWed, 05 Aug 2026 07:48:52 +0800https://silo.pgsty.com/blog/security/source-address-trust/Tue, 04 Aug 2026 00:00:00 +0000https://silo.pgsty.com/blog/security/source-address-trust/<p><strong>Status:</strong> Landed on <code>pgsty/minio</code> <code>master</code> as <code>fe6dc4780</code>, <strong>unreleased</strong> <strong>Classification:</strong> Opt-in hardening plus a documentation defect, <strong>not a vulnerability and not a regression</strong>; no CVE assigned. The underlying weakness is inherited from upstream and its default behaviour is unchanged here <strong>Affected scope:</strong> <code>aws:SourceIp</code> policy conditions, the audit log <code>remotehost</code> field, S3 event notification <code>Host</code>, and the client shown by <code>mc admin trace</code> — on any deployment whose S3 API port is reachable without passing through a header-sanitising proxy <strong>Upstream:</strong> nothing to file — <code>minio/minio</code> is archived. Prior art there: <a href="https://github.com/minio/minio/pull/4736">PR #4736</a> (2017, the concern raised and half-addressed), <a href="https://github.com/minio/minio/discussions/17878">discussion #17878</a> (2023, maintainer marks it working as intended), <a href="https://github.com/minio/minio/pull/20977">PR #20977</a> (2025, the partial switch)</p>