GHSA-2625-rw7m-5q5x: Hubuum client library (Rust) Sensitive Data May Be Exposed Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2625-rw7m-5q5x",
  "modified" : "2026-07-24T21:49:18Z",
  "published" : "2026-07-24T21:49:18Z",
  "aliases" : [ ],
  "summary" : "Hubuum client library (Rust): Sensitive data may be exposed through default diagnostics",
  "details" : "## Summary\n\n`hubuum_client` diagnostics can expose sensitive request, response, import/export, task, delivery, or server-provided data when applications format or log errors and public models.\n\n## Affected behavior\n\nNative `reqwest::Error` values retain the full request URL. Converting those errors into `ApiError::Http`, or exhausting retries and storing the error text in `ApiError::RetryExhausted`, preserves query parameter values. Detailed HTTP and decoding errors can retain server-provided messages, response bodies, or payload details, including through error source chains.\n\nSeveral public response and model types also derived or implemented diagnostics over untrusted or secret-adjacent fields. These include raw response bodies and cursors; rendered and JSON export payloads; import schemas and object data; task summaries, links, output URLs, events, and import-result details; event-delivery claims and errors; event sink configuration; subscription routing; and remote-call failure details. High-level backup and export runners additionally copied unsuccessful server task summaries into `ApiError::Api`.\n\nApplications commonly log errors and response values, so credentials, tokens, cursors, filters, echoed request content, imported object data, schema defaults, task or delivery details, and other sensitive payloads can be written to logs even though normal request logging redacts query values.\n\n## Remediation\n\nThe proposed fix redacts query values from embedded request URLs before storing native HTTP errors and applies the same sanitization to exhausted retries. Default error and model diagnostics now report safe metadata rather than server messages, payloads, cursors, links, configuration, or secret-adjacent details. JSON codec errors no longer appear in the standard source chain, and unsuccessful high-level backup/export operations use the structured `TaskUnsuccessful` variant without copying task summaries.\n\nExplicit response, error, task, import, export, event, and delivery APIs continue to expose original values for applications that deliberately inspect them.\n\n## Validation\n\nRegression coverage exercises direct HTTP conversion, async and blocking retry exhaustion, response and decoding diagnostics, import/export/raw-response containers, unsuccessful async and blocking task runners, task/event/import-result models, and secret-bearing event and remote models. The workspace format, lint, documentation, test, feature-matrix, Rust 1.88 MSRV, OpenAPI validation, release-metadata, and combined library plus consumer integration suites pass against the immutable Hubuum 0.0.3 image.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "hubuum_client"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.6.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.6.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/hubuum/hubuum-client-rust/security/advisories/GHSA-2625-rw7m-5q5x"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/hubuum/hubuum-client-rust/commit/5a5c275ffa45f342459b7d3e977926da643bde50"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/hubuum/hubuum-client-rust"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/hubuum/hubuum-client-rust/releases/tag/v0.6.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-532" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-24T21:49:18Z",
    "nvd_published_at" : null
  }
}