「CVE-2026-113799」の検索結果
10月22日(木)今日
Slack Morphism verifier errors disclose valid HMACs in the logs
影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0 Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…