PT-2022-24956 · Alibaba · Aliyun-Oss-Client

Tu6Ge · Published 2022-11-19 · Updated 2023-07-12 · CVE-2022-39397

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions aliyun-oss-client versions prior to 0.8.1

Description The aliyun-oss-client unintentionally divulges the authentication secret. Users of this library will be affected, as the incoming secret will be disclosed unintentionally.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update can be applied.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-39397

GHSA-3W3H-7XGX-GRWC

RUSTSEC-2022-0089

Affected Products

Aliyun-Oss-Client

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39397.json · Exploit
• https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29 · Patch
• https://osv.dev/vulnerability/CVE-2022-39397 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2022-0089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3w3h-7xgx-grwc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39397 · Security Note
• https://github.com/tu6ge/oss-rs/security/advisories/GHSA-3w3h-7xgx-grwc · Note
• https://github.com/tu6ge/oss-rs · Note
• https://t.me/cibsecurity/53377 · Telegram Post
• https://t.me/cvenotify/54113 · Telegram Post
• https://t.me/cvenotify/38579 · Telegram Post
• https://github.com/advisories/GHSA-3w3h-7xgx-grwc · Note
• https://rustsec.org/advisories/RUSTSEC-2022-0089.html · Note
• https://crates.io/crates/aliyun-oss-client · Note