Skip to content
OpenAdvisories

Package · Go

github.com/slack-go/slack

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium —
    GHSA-gxhx-2686-5h9g

    slack-go `SecretsVerifier` accepts empty signing secret without precondition

    `SecretsVerifier` in slack-go/slack before v0.23.1 accepts an empty signing secret without error. If an application is misconfigured (e.g., an unset or empty `SLACK_SIGNING_SECRET`), `NewSecretsVerifier` builds an HMAC-SHA256 keyed with an empty string, allow…

    github.com/slack-go/slack Go