Security Bulletin for FlashBlade Object Store Privileged Access Vulnerability CVE-2023-28372

Summary 

A flaw exists whereby a user with privileges to extend an object’s retention period can  affect the availability of the object lock

References:

• https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html

• https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObjectRetention.html

Corrective Action

• This issue is present in FlashBlade Purity (OE) version 4.1.0.
• This issue is first resolved starting in FlashBlade Purity (OE) version 4.1.1. or later