GitHub Advisoryadvisory · crates.io

GHSA-99j7-mhfh-w84p Slack Morphism for Rust before 0.41.0 can leak Slack OAuth client information in application debug logs

HIGH Published 2022-07-20 Modified 2022-08-10 Official page ↗
Aliases
CVE-2022-31162
Ecosystem
crates.io
Packages
slack-morphism
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1258, CWE-200, CWE-212
Reviewed
2022-07-20

Affected packages

• crates.io slack-morphism: < 0.41.0 → fixed in 0.41.0

Description

Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't print/output in logs request and responses for OAuth and client configurations. For more information If you have any questions or comments about this advisory: • Open an issue in the repo • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2022-31162 Slack Morphism is an async client library for Rust. vulnerability

Weakness · CWE (3)

  • CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References