Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

azure_security_keyvault_secrets

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Unratedcrates.ioPublished

    Rejected authentication challenges can poison the Key Vault scope cache

    Affected
    • crates.io azure_security_keyvault_secrets >= 0.10.0, < 1.0.1
    Fixed in
    1.0.1· Vendor fix available
    Issue
    Affected versions of `KeyVaultAuthorizer::on_challenge` cache the authentication scope from a `WWW-Authenticate` response before verifying that the challenge resource matches the requested endpoint. When verification rejects the challenge, the scope remains cached. A subsequent request through the same client uses that scope to authorize the request without repeating challenge resource verification. For `azure_security_keyvault_secrets`, the affected versions are `0.10.0` through `1.0.0`, inclusive. Versions before `0.10.0` do not use this challenge-scope cache and are unaffected by this issue. The published `1.1.0-beta.1` already includes the fix. Impact An application that sends requests to an attacker-controlled endpoint and reuses the same client after a rejected challenge can disclose a bearer token and request body to that endpoint, if its credential can obtain a token for the supplied scope. The first request's validation error therefore does not prevent disclosure on a…

    Recommended action: Upgrade to 1.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →