Vulnerability GHSA-4mjx-2gh5-ph8h
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
October 10, 2022 at 09:07 PM UTC
Exposure of sensitive Slack webhook URLs in debug logs and traces
0.1.0 - 1.3.1
0.1.0 - 1.3.1
Summary
Exposure of sensitive Slack webhook URLs in debug logs and traces
Details
Impact
Debug logs expose sensitive URLs for Slack webhooks that contain private information.
Patches
The problem is fixed in v1.3.2 which redacts sensitive URLs for webhooks.
Workarounds
Disabling/filtering debug logs in case you use Slack webhooks using tracing log level and filters.
References
https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2
For more information
If you have any questions or comments about this advisory:
- Open an issue in repo
- Read our security policy
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
Slack Morphism verifier errors disclose valid HMACs in the logs
1.0.0 - 2.27.0 GHSA-26w4-8w32-4x3v
1.0.0 - 2.27.0 GHSA-26w4-8w32-4x3v
Unknown
4 years ago
Slack Webhooks secrets leak in debug logs
0.1.0 - 1.3.1 RUSTSEC-2022-0087
0.1.0 - 1.3.1 RUSTSEC-2022-0087
High Risk
4 years ago
Slack OAuth Secrets leak in debug logs
0.1.0 - 0.40.0 RUSTSEC-2022-0086
0.1.0 - 0.40.0 RUSTSEC-2022-0086
High Risk
4 years ago
Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs
0.1.0 - 0.40.0 GHSA-99j7-mhfh-w84p
0.1.0 - 0.40.0 GHSA-99j7-mhfh-w84p
Impacted packages
Timeline
Published
4 years ago
October 10, 2022 at 09:07 PM UTC
Fixed (1.3.2)
4 years ago
October 08, 2022 at 12:58 PM UTC
Last Modified
2 years ago
November 08, 2023 at 04:10 AM UTC