---
id: CVE-2022-39397
aliases:
  - RUSTSEC-2022-0089
  - GHSA-3w3h-7xgx-grwc
title: '`aliyun-oss-client` secret exposure'
summary: '`aliyun-oss-client` secret exposure'
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N'
vendor: aliyun-oss-client
product: aliyun-oss-client
ecosystem: rust
affected:
  - 'aliyun-oss-client >= 0.0.0-0, < 0.8.1'
patched:
  - aliyun-oss-client 0.8.1
published: '2022-11-19'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:06.806151142Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2022-0089'
references:
  - url: 'https://crates.io/crates/aliyun-oss-client'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2022-0089.html'
  - url: >-
      https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29
tags:
  - osv
  - rust
epss: 0.00457
epssPercentile: 0.39463
ingestedAt: '2026-10-13T11:45:30.159Z'
---

## Overview

The `aliyun-oss-client` unintentionally divulges the authentication secret.

This bug was fixed in [this](https://github.com/tu6ge/oss-rs/commit/e4553f7d74fce682d802f8fb073943387796df29) commit by limiting the concerned traits to be `pub` only within the crate.

## Affected packages

- `aliyun-oss-client >= 0.0.0-0, < 0.8.1`

## Remediation

Upgrade to a patched release:

- `aliyun-oss-client 0.8.1`