CVE-2023-46739: Timing attack can leak user passwords
A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords.
The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component.
CubeFS has not seen any evidence of this being exploited in the wild. The vulnerability was found during a security audit conducted by Ada Logics in collaboration with OSTIF and the CNCF.
The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
Other sources
CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46739?
CVE-2023-46739 has a high severity rating due to the potential for password theft through timing attacks.
How do I fix CVE-2023-46739?
To fix CVE-2023-46739, upgrade your CubeFS version to 3.3.1 or later, where the vulnerability is addressed.
What causes CVE-2023-46739?
CVE-2023-46739 is caused by CubeFS using raw string comparison for password validation, making it susceptible to timing attacks.
Which versions of CubeFS are affected by CVE-2023-46739?
CVE-2023-46739 affects CubeFS versions prior to 3.3.1.
Can CVE-2023-46739 impact user data privacy?
Yes, CVE-2023-46739 can significantly impact user data privacy by allowing attackers to potentially steal passwords.