CVE-2023-30610

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

CVE-2023-30610

The CVE affects aws-sigv4 in the AWS SDK for Rust: the SigningParams Debug output can expose a user’s AWS access key, secret key, and session token when TRACE-level logging is enabled, allowing credentials to appear in logs. Affected users should upgrade to fixed releases; patches are listed acro...

CVE-2023-30610 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

aware (>=0.0.9, <=0.0.13), aws-config (>=0.4.0, <=0.4.1) +304 more potentially affected by CVE-2023-30610 via aws-sigv4 (0.4.2)

aws-sigv4 CARGO version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on aws-sigv4 and may be impacted: - aware =0.0.9, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.1 and more...

aware (>=0.0.1, <=0.0.6), aws-config (>=0.0.22-alpha, <=0.0.26-alpha) +288 more potentially affected by CVE-2023-30610 via aws-sigv4 (>=0.0.22-alpha, <=0.0.26-alpha)

aws-sigv4 CARGO version =0.0.22-alpha, =0.0.1, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.22-alpha, =0.0.26-alpha and more Source cves:...