CVE-2023-46742: CubeFS leaks users key in logs
CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.
Other sources
CubeFS was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves.
There is no evidence of this vulnerability being exploited in the wild. It was found during an ongoing security audit carried out by Ada Logics in collaboration with OSTIF and the CNCF.
The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46742?
CVE-2023-46742 has been categorized as a security vulnerability that can impact data confidentiality.
How do I fix CVE-2023-46742?
To fix CVE-2023-46742, upgrade CubeFS to version 3.3.1 or later.
What components of CubeFS are affected by CVE-2023-46742?
CVE-2023-46742 affects multiple components of CubeFS where secret keys and access keys are logged.
What information is leaked in CVE-2023-46742?
CVE-2023-46742 results in the leakage of users' secret keys and access keys in the logs.
Who is at risk from CVE-2023-46742?
Lower-privileged users may exploit CVE-2023-46742 to gain access to sensitive information such as secret keys.