Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generatedhash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read its application/service logs can therefore use the verifier as a chosen-message HMAC oracle. The attacker can send an arbitrary request with an invalid signature, recover the correct signature from the resulting log entry, and resend the same request within the five-minute freshness window. The second request passes Slack Morphism's signature verification and reaches the protected application callback without the attacker knowing the Slack signing secret. I reproduced this end-to-end against…
Recommended action: Upgrade to 2.28.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Debug logs expose sensitive URLs for Slack webhooks that contain private information. Patches The problem is fixed in v1.3.2 which redacts sensitive URLs for webhooks. Workarounds Disabling/filtering debug logs in case you use Slack webhooks using tracing log level and filters. References https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2 For more information If you have any questions or comments about this advisory: Open an issue in repo Read our security policy
Recommended action: Upgrade to 1.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Potential/accidental leaking of Slack OAuth client information in application debug logs. Patches More strict and secure debug formatting was introduced in v0.41 for OAuth secret types to avoid the possibility of printing sensitive information in application logs. Workarounds Don't print/output in logs request and responses for OAuth and client configurations. For more information If you have any questions or comments about this advisory: Open an issue in the repo Email us at me@abdolence.dev
Recommended action: Upgrade to 0.41.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.