Sensitive Data Exposure in Hubuum Client Library: Default Diagnostics Issue
Summary
GHSA-2625-rw7m-5q5x: Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics. Affects hubuum_client versions < 0.6.1. Fixed in 0.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Hubuum client library, available on crates.io, is designed for seamless interaction with the Hubuum API, facilitating tasks such as data import/export and event handling. It is widely used in Rust applications for its efficiency and ease of use. However, a significant vulnerability has been identified that may expose sensitive data through its default diagnostics, particularly when logging errors or public models.
Vulnerability Detail
The vulnerability arises from the native reqwest::Error values retaining full request URLs, which can include sensitive query parameters. When these errors are converted into ApiError::Http or ApiError::RetryExhausted, they preserve potentially sensitive information. Additionally, public response and model types may inadvertently expose untrusted or secret-adjacent fields, including raw response bodies, task details, and server-provided messages. This can lead to sensitive data being logged, such as credentials and tokens, which poses a security risk for applications that log errors and responses.
How To Fix
Minimum fixed version
0.6.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers should avoid logging raw error messages and sensitive response details. Instead, implement custom logging that filters out sensitive information before it is written to logs.
Conclusion
The Hubuum client library has a vulnerability that can expose sensitive data through its default diagnostics. It is crucial for developers using this library to update to version 0.6.1 or later to mitigate this risk. Additionally, implementing logging best practices can help protect sensitive information.
See every vulnerability recorded for hubuum_client →
FAQ
The vulnerability allows sensitive data to be exposed through default diagnostics when errors are logged, potentially including credentials and tokens.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 2.3, indicating a low severity level.
Update the Hubuum client library to version 0.6.1 or later to ensure that sensitive data is not logged.
Yes, as a workaround, avoid logging raw error messages and implement custom logging to filter out sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for hubuum_client.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
