Executive brief
Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
Affected products
- Go github.com/cubefs/cubefs
Junglewise Threat Intelligence
CVE-2023-46740: GO-2024-2431 - Insecure random string generator used for sensitive data in github.com/cubefs/cubefs
CVE-2023-46740 · Severity: low · CVSS 3.1 · Published 2024-06-28
Technologies: github.com/cubefs/cubefs (Go). Vendors: Go.
Related threats
- GO-2024-2434 - CubeFS leaks users key in logs in github.com/cubefs/cubefs
- GO-2024-2433 - CubeFS leaks magic secret key when starting Blobstore access service in github.com/cubefs/cubefs
- GO-2024-2430 - Authenticated users can crash the CubeFS servers with maliciously crafted requests in github.com/cubefs/cubefs
- GO-2024-2432 - CubeFS timing attack can leak user passwords in github.com/cubefs/cubefs
- CubeFS allows Kubernetes cluster-level privilege escalation