Slack Morphism verifier errors disclose valid HMACs in the logs

影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0

Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…

GitHub Advisory Databaseで読む

2026/10/22 01:38、GitHub Advisory Databaseが「Slack Morphism verifier errors disclose valid HMACs in the logs」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Rust、Slack。CVE: CVE-2026-113799。