TI-2023-25222 Aliases CVE-2023-46739 GHSA-8579-7p32-f398

Timing attack can leak user passwords

LOW 31CWE-203Published 2024-01-03 · Updated 2025-06-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-203.

Summary

CubeFS is an open-source cloud-native file storage system. A vulnerability was found during in the CubeFS master component in versions prior to 3.3.1 that could allow an untrusted attacker to steal user passwords by carrying out a timing attack. The root case of the vulnerability was that CubeFS used raw string comparison of passwords. The vulnerable part of CubeFS was the UserService of the master component. The UserService gets instantiated when starting the server of the master component. The issue has been patched in v3.3.1. For impacted users, there is no other way to mitigate the issue besides upgrading.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00353 29th percentileScored 2026-11-07

Fix Fixed cubefs (cubefs): 3.3.1github.com/cubefs/cubefs (Go): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
backstage	cubefs	before 3.3.1	3.3.1	Patch available	CNA
—	github.com/cubefs/cubefs (Go)	before 3.3.1	3.3.1	Patch available	GHSA-8579-7p32-f398

cubefs Vendorbackstage Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA
github.com/cubefs/cubefs (Go) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-8579-7p32-f398

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:linuxfoundation:cubefs::::::::	before 3.3.1	Vulnerable	backstage

cpe:2.3:a:linuxfoundation:cubefs:*:*:*:*:*:*:*:* Versions before 3.3.1 Vulnerable ·backstage

Remediation

Fix · CNA cubefs (cubefs) Fixed in 3.3.1
Fix · GHSA-8579-7p32-f398 github.com/cubefs/cubefs (Go) Fixed in 3.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-46739
2026-10-03 Alias added: GHSA-8579-7p32-f398

References

Patch 1

https://github.com/cubefs/cubefs/commit/6a0d5fa45a77ff20c752fa9e44738bf5d86c84bd

Advisory 2

Other 2

TI-2023-25223 Insecure random string generator used for sensitive data CVSS 3.1CRITICAL 9.8
TI-2023-25224 CubeFS leaks magic secret key when starting Blobstore access service CVSS 3.1CRITICAL 9.8
TI-2023-14347 CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. CVSS 3.1MEDIUM 6.5
TI-2023-25221 Authenticated users can crash the CubeFS servers with maliciously crafted requests CVSS 3.1MEDIUM 6.5
TI-2023-25225 CubeFS leaks users key in logs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences