Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/cubefs/cubefs
  4. ›
  5. CVE-2023-46742

CVE-2023-46742: Insertion of Sensitive Information into Log File

January 3, 2024

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to the logs to retrieve sensitive information and impersonate other users with higher privileges than themselves. The issue has been patched in v3.3.1. There is no other mitigation than upgrading CubeFS.

References

  • github.com/advisories/GHSA-vwch-g97w-hfg2
  • github.com/cubefs/cubefs/commit/8dccce6ac8dff3db44d7e9074094c7303a5ff5dd
  • github.com/cubefs/cubefs/security/advisories/GHSA-vwch-g97w-hfg2
  • nvd.nist.gov/vuln/detail/CVE-2023-46742

Code Behaviors & Features

Detect and mitigate CVE-2023-46742 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 3.3.1

Fixed versions

  • v3.3.1

Solution

Upgrade to version 3.3.1 or above.

Impact 4.8 MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Learn more about CVSS

Weakness

  • CWE-532: Insertion of Sensitive Information into Log File

Source file

go/github.com/cubefs/cubefs/CVE-2023-46742.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:14:43 +0000.