Threats Tagged 'ghsa-qqc3-94qv-7fw3'

The hubuum_client Rust library versions 0.3.0 up to but not including 0.6.1 has a vulnerability where configured custom transports can be bypassed. Several client operations, including password login and token validation, use the built-in reqwest client directly instead of the custom transport, potentially exposing credentials and network traffic outside intended security controls. This bypass affects network isolation, proxy enforcement, request signing, audit logging, and policy checks. A fix has been proposed to route all relevant calls through the configured transport and disable redirect following in built-in clients to maintain endpoint validation.