https://silo.pgsty.com/zh/tags/compliance/ Recent content in Compliance on SILO Hugo zh-CN Sat, 24 Oct 2026 18:19:49 +0800 https://silo.pgsty.com/zh/blog/security/20260926-governance-retention-bypass/ Sat, 26 Sep 2026 00:00:00 +0000 https://silo.pgsty.com/zh/blog/security/20260926-governance-retention-bypass/ <p><strong><code>SN-2026-015</code></strong> 与 <strong><code>SN-2026-016</code></strong> 涵盖了在 <a href="https://silo.pgsty.com/zh/blog/release/silo-20261018/">SILO Server 20261018</a> 中通过 PR <a href="https://github.com/pgsty/silo/pull/234"><code>#234</code></a>（<code>14042b5aa</code>）与 PR <a href="https://github.com/pgsty/silo/pull/235"><code>#235</code></a>（<code>0d3ba5d4c</code>）修复的两组 S3 Object Lock 合规保留与不可变性漏洞（配套<a href="https://silo.pgsty.com/zh/blog/design/governance-retention-bypass-repair/">修复设计方案</a>）。虽然删除路径此前已按 <a href="https://github.com/minio/minio/security/advisories/GHSA-c8fc-mjj8-fc63">CVE-2023-25812</a> 正确校验 <code>s3:BypassGovernanceRetention</code>，但保留期修改路径（<code>PutObjectRetention</code>）与四条原地版本覆写路径仍存在绕过缺陷。</p>