CVE-2022-31162
Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.87%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.87% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-1258, CWE-212
- Affected
- slack morphism project/slack morphism
- Source
- security-advisories@github.com
References
- https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0Release Notes, Third Party Advisory
- https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84pThird Party Advisory
- https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0Release Notes, Third Party Advisory
- https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84pThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.