Slack Morphism verifier errors disclose valid HMACs in the logs

影響: rust:slack-morphism >= 1.0.0, <= 2.27.0 → 2.28.0

Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generated_hash. The error's Debug and Display representations expose that value, and the default Axum listener error handler logs it at error level. An attacker who can both reach the application's Slack callback endpoint and read…

在 GitHub Advisory Database 阅读

2026/10/22 01:38，GitHub Advisory Database 发布了“Slack Morphism verifier errors disclose valid HMACs in the logs”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：Rust、Slack。CVE：CVE-2026-113799。