CVE-2022-39397

Exposure of sensitive information in aliyun-oss-client

5.6 MediumFix available

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.47%Down 0.4 points since Nov 23, 2022

What each source reports

CVE List Score used 5.6

Exposure of sensitive information in aliyun-oss-client

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Record: CVE-2022-39397
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-200
Updated: 2026-11-02

EUVDEUVD-2022-7215 5.6

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Record: EUVD-2022-7215
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-3w3h-7xgx-grwc 5.6

Leak in Aliyun KeySecret

Impact

Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally.

Patches

This have already been solved.

Workarounds

No, It cannot be patched without upgrading

References

For more information

If you have any questions or comments about this advisory:

Email us at email address

Record: GHSA-3w3h-7xgx-grwc
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-200
Updated: 2026-11-02

NVD 5.6

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Record: CVE-2022-39397
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV 5.6

Exposure of sensitive information in aliyun-oss-client

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Record: CVE-2022-39397
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-3w3h-7xgx-grwc 5.6

Leak in Aliyun KeySecret

Impact

Users of this library will be affected when using this library, the incoming secret will be disclosed unintentionally.

Patches

This have already been solved.

Workarounds

No, It cannot be patched without upgrading

References

For more information

If you have any questions or comments about this advisory:

Email us at email address

Record: GHSA-3w3h-7xgx-grwc
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVRUSTSEC-2022-0089 5.6

`aliyun-oss-client` secret exposure

The aliyun-oss-client unintentionally divulges the authentication secret.

This bug was fixed in this commit by limiting the concerned traits to be pub only within the crate.

Record: RUSTSEC-2022-0089
CVSS 3.1: 5.6 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`aliyun-oss-client` crates.io	before 0.8.1	0.8.1
`aliyun-oss-client` crates.io	0.0.0-0 up to 0.8.1	0.8.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-39397 is a medium vulnerability (CVSS 5.6) in Aliyun-oss-client Project Aliyun-oss-client, published November 19, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in aliyun-oss-client 0.8.1.