Hubuum Client Library: Potential Sensitive Data Exposure Through Diagnostics
An early warning has been issued regarding the Hubuum client library, which reportedly may expose sensitive data through its default diagnostics. Users of affected versions should upgrade to 0.6.1 and review their logs.
What happened
The Hubuum client library, specifically versions introduced between 0.0.1 and 0.6.0, appears to expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models. This exposure is under investigation and is associated with the Hubuum client's default diagnostics functionality.
To assess your exposure, check if your application uses any version of the Hubuum client within the affected range (0.0.1 to 0.6.0). If so, it is recommended to upgrade to version 0.6.1, which reportedly fixes the issue. Additionally, review your application logs for any signs of sensitive data exposure.
For more detailed information, consult the primary source at https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-2625-rw7m-5q5x. This advisory provides further context and guidance on mitigating the potential risk.
How 0Day mitigates this
hubuum_client is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.