{"id":"RUSTSEC-2022-0089","revision":"1b07d050c516432ab795d11000f69e35","records":[{"revision":"1b07d050c516432ab795d11000f69e35","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0089","aliases":["CVE-2022-39397","GHSA-3w3h-7xgx-grwc"],"title":"`aliyun-oss-client` secret exposure","description":"The `aliyun-oss-client` unintentionally divulges the authentication secret.\n\nThis bug was fixed in [this](https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29) commit by limiting the concerned traits to be `pub` only within the crate.","state":0,"publishedAt":"2022-11-19T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:06.8061511+00:00","affected":[{"ecosystem":"crates.io","name":"aliyun-oss-client","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.8.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/aliyun-oss-client","https://rustsec.org/advisories/RUSTSEC-2022-0089.html","https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0089","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0089","identifiers":["RUSTSEC-2022-0089","CVE-2022-39397","GHSA-3w3h-7xgx-grwc"]},"retained":false,"historicalAffected":[]}],"coverage":[]}