Rust advisories / aliyun-oss-client
Vulnerability MediumRUSTSEC-2022-0089 · aliyun-oss-client
RUSTSEC-2022-0089: `aliyun-oss-client` secret exposure
Short answerA security vulnerability in the aliyun-oss-client crate: `aliyun-oss-client` secret exposure. Medium severity (CVSS 5.6). Fixed in 0.8.1: update to a fixed version.
| Crate | aliyun-oss-client |
|---|---|
| Type | Vulnerability (crypto-failure) |
| Affected versions | Before 0.8.1. |
| Fixed in | 0.8.1 |
| Severity | Medium, CVSS 5.6 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N |
| Published | 2022-11-19 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2022-39397, GHSA-3w3h-7xgx-grwc |
What to do
- See which version you have:
cargo tree -i aliyun-oss-client(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p aliyun-oss-client. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplealiyun-oss-client = "0.8.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The aliyun-oss-client unintentionally divulges the authentication secret.
This bug was fixed in this commit by limiting the concerned traits to be pub only within the crate.
References
- Package: crates.io/crates/aliyun-oss-client
- Advisory: rustsec.org/advisories/RUSTSEC-2022-0089.html
- Web: github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?