Vulnerability GHSA-99j7-mhfh-w84p
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
July 20, 2022 at 01:30 AM UTC
Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs
0.1.0 - 0.40.0
0.1.0 - 0.40.0
Summary
Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs
Details
Impact
Potential/accidental leaking of Slack OAuth client information in application debug logs.
Patches
More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs.
Workarounds
Don't print/output in logs request and responses for OAuth and client configurations.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the repo
- Email us at [email protected]
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
Slack Morphism verifier errors disclose valid HMACs in the logs
1.0.0 - 2.27.0 GHSA-26w4-8w32-4x3v
1.0.0 - 2.27.0 GHSA-26w4-8w32-4x3v
High Risk
4 years ago
Exposure of sensitive Slack webhook URLs in debug logs and traces
0.1.0 - 1.3.1 GHSA-4mjx-2gh5-ph8h
0.1.0 - 1.3.1 GHSA-4mjx-2gh5-ph8h
Unknown
4 years ago
Slack Webhooks secrets leak in debug logs
0.1.0 - 1.3.1 RUSTSEC-2022-0087
0.1.0 - 1.3.1 RUSTSEC-2022-0087
High Risk
4 years ago
Slack OAuth Secrets leak in debug logs
0.1.0 - 0.40.0 RUSTSEC-2022-0086
0.1.0 - 0.40.0 RUSTSEC-2022-0086
Impacted packages
Timeline
Published
4 years ago
July 20, 2022 at 01:30 AM UTC
Fixed (0.41.0)
4 years ago
July 16, 2022 at 11:20 AM UTC
Last Modified
2 years ago
November 08, 2023 at 04:09 AM UTC