Abdolence

**Name of the Vulnerable Software and Affected Versions** Slack Morphism versions prior to 1.3.2 **Description** The issue is related to the exposure of sensitive information in debug logs. Specifically, debug logs may contain sensitive URLs for Slack webhooks that include private information. This could allow a remote attacker to gain unauthorized access to protected information. **Recommendations** For versions prior to 1.3.2, update to version 1.3.2, which redacts sensitive URLs for webhooks. As a temporary workaround, consider disabling or filtering debug logs, especially when using Slack webhooks, by adjusting the tracing log level and filters.

**Name of the Vulnerable Software and Affected Versions** Slack Morphism versions prior to 0.41.0 **Description** The issue concerns the potential leakage of Slack OAuth client information into application debug logs due to insecure debug log formatting. This could lead to the accidental exposure of sensitive information. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 0.41.0, update to version 0.41.0 or later to introduce stricter and more secure debug formatting for OAuth secret types. As a temporary workaround, do not print/output requests and responses for OAuth and client configurations in logs.