Hubuum Client Library Vulnerability: Authenticated Requests May Escape Base Path
An early warning has been issued regarding a vulnerability in the Hubuum client library for Rust, where authenticated requests may escape the configured base path through redirects, potentially exposing sensitive data.
What happened
Reportedly, the Hubuum client library for Rust allows authenticated requests to escape the configured base path through redirects. This appears to lead to the bearer Authorization header being carried outside the configured Hubuum path prefix. The issue is under investigation, and it is recommended to upgrade to version 0.6.1 of the Hubuum client library or configure a reqwest client with `reqwest::redirect::Policy::none()` to mitigate potential exposure. Affected components include the hubuum client library (cargo) versions prior to 0.6.1. For more details, primary sources should be consulted.
How 0Day mitigates this
hubuum client library is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.