CVE-2023-46739

CVE-2023-46739 affects CubeFS (open-source cloud-native file storage). In the CubeFS master component, the UserService uses raw string comparison for passwords, enabling a timing-attack which could leak user passwords. This vulnerability exists in versions prior to 3.3.1 and is fixed in v3.3.1; u...

CVE-2023-46738

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

Design/Logic Flaw

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

GHSA-VWCH-G97W-HFG2 CubeFS leaks users key in logs

CubeFS was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher...

CubeFS leaks users key in logs

CubeFS was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher...

CubeFS leaks magic secret key when starting Blobstore access service

A vulnerability was found in CubeFS that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not ha...

GHSA-8H2X-GR2C-C275 CubeFS leaks magic secret key when starting Blobstore access service

A vulnerability was found in CubeFS that could allow users to read sensitive data from the logs which could allow them escalate privileges. CubeFS leaks configuration keys in plaintext format in the logs. These keys could allow anyone to carry out operations on blobs that they otherwise do not ha...

Insecure random string generator used for sensitive data

CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...

GHSA-4248-P65P-HCRM Insecure random string generator used for sensitive data

CubeFS used an insecure random string generator to generate user-specific, sensitive keys used to authenticate users in a CubeFS deployment. This could allow an attacker to predict and/or guess the generated string and impersonate a user thereby obtaining higher privileges. When CubeFS creates ne...

CubeFS timing attack can leak user passwords

A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the...

GHSA-8579-7P32-F398 CubeFS timing attack can leak user passwords

A vulnerability was found during in the CubeFS master component that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the...

Authenticated users can crash the CubeFS servers with maliciously crafted requests

A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...

GHSA-QC6V-G3XW-GRMX Authenticated users can crash the CubeFS servers with maliciously crafted requests

A security vulnerability was found in CubeFS HandlerNode that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cause was improper handling of incoming HTTP requests that could allow an attacker to...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CVE-2023-46738

CVE-2023-46738 affects CubeFS HandlerNode (versions before 3.3.1). A malicious, authenticated user can trigger a crafted HTTP request that causes the ObjectNode to allocate memory beyond available limits, leading to memory exhaustion and denial of service. Root cause: improper handling of incomin...

CVE-2023-46738 Authenticated users can crash the CubeFS servers with maliciously crafted requests

CubeFS is an open-source cloud-native file storage system. A security vulnerability was found in CubeFS HandlerNode in versions prior to 3.3.1 that could allow authenticated users to send maliciously-crafted requests that would crash the ObjectNode and deny other users from using it. The root cau...

CubeFS Security Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security vulnerability exists in CubeFS versions prior to 3.3.1, which stems from leaking configuration keys in plaintext format in logs. An attacker exploited the vulnerability to read sensitive data from logs to escalate...

CubeFS Security Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A security vulnerability exists in CubeFS versions prior to 3.3.1 that stems from improper handling of incoming HTTP requests. An attacker can exploit the vulnerability to control the amount of memory allocated by an ObjectNo...

CubeFS Log Information Disclosure Vulnerability

CubeFS is a cloud-native file storage for CubeFS individual developers. A log information disclosure vulnerability exists in CubeFS versions prior to 3.3.1, which stems from disclosing user keys and access keys in logs...