← Back

CVE-2023-30610

nvd nist
Published: Apr 19, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Affected (24)

Products: Amazon: Aws Sigv4
1 product
Aws Sigv4
Configuration A
24 vulnerable
Vulnerable SoftwareAffected Versions
Amazon
Version 0.10.1
Version 0.11.0
Version 0.12.0
Version 0.13.0
Version 0.14.0
Version 0.15.0
Version 0.2.0
Version 0.3.0
Version 0.4.1
Version 0.46.0
Version 0.47.0
Version 0.48.0
Version 0.49.0
Version 0.5.2
Version 0.50.0
Version 0.51.0
Version 0.52.0
Version 0.53.1
Version 0.54.1
Version 0.55.0
Version 0.6.0
Version 0.7.0
Version 0.8.0
Version 0.9.0

References (2)

Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.