Slack Morphism verifier errors disclose valid HMACs in the logs

影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0

Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…

GitHub Advisory Database에서 읽기

2026. 10. 22. 오전 01:38, GitHub Advisory Database에서 "Slack Morphism verifier errors disclose valid HMACs in the logs"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Rust, Slack. CVE: CVE-2026-113799.