CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

CVE-2024-41178

creationtimestamp| type| source ---|---|--- 2024-07-23 19:44:45+00:00| seen| https://t.me/cvedetector/1519...

ballista (>=0.8.0, <=0.9.0), ballista-cli (0.9.0) +52 more potentially affected by CVE-2024-41178 via object_store (>=0.5.6, <=0.9.1)

objectstore CARGO version =0.5.6, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.4.0, =0.7.0, =0.0.1, =0.0.0, =12.0.0, =12.0.0, =12.0.0, =20.0.0, =38.0.0 - datafusion-expr 31.0.0 - datafusion-extra 0.0.2 and more Source cves: CVE-2024-41178 Source advisory: OSV:GHSA-C2HF-VCMR-QJRF...

CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

CVE-2024-41178 vulnerabilities

Vulnerabilities for packages: parseable, qdrant...

CVE-2024-41178 vulnerabilities

Vulnerabilities for packages: qdrant, parseable...

CVE-2024-41178 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

CVE-2024-41178

The Apache Arrow Rust Object Store (object_store crate) versions 0.10.1 and earlier are vulnerable to credential exposure when using AWS WebIdentityTokens on all platforms. Under specific error conditions involving automatic retries, the underlying reqwest error—which may include the full URL wit...

ballista (>=0.8.0, <=0.9.0), ballista-cli (0.9.0) +52 more potentially affected by CVE-2024-41178 via object_store (>=0.5.6, <=0.9.1)

objectstore CARGO version =0.5.6, =0.8.0, =0.8.0, =0.8.0, =0.8.0, =0.4.0, =0.7.0, =0.0.1, =0.0.0, =12.0.0, =12.0.0, =12.0.0, =20.0.0, =38.0.0 - datafusion-expr 31.0.0 - datafusion-extra 0.0.2 and more Source cves: CVE-2024-41178 Source advisory: OSV:RUSTSEC-2024-0358...