Skip to content
Fencer Vulns
medium 5.5

CVE-2023-30610 json

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

published 2023-04-19 3 y ago modified 2026-10-12 27 d ago also GHSA-mjv9-vp6w-3rc9 , RUSTSEC-2023-0125 , EUVD-2023-1355

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Patch / fix

  • crates.io aws-sigv4 0.2.1, 0.3.1, 0.4.2, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.50.1, 0.51.1, 0.52.1, 0.53.2, 0.54.2, 0.55.1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
crates.io aws-sigv4
>=0.55.0, <0.55.1
>=0.54.1, <0.54.2
>=0.53.1, <0.53.2
>=0.52.0, <0.52.1
>=0.51.0, <0.51.1
>=0.49.0, <0.49.1
>=0.48.0, <0.48.1
>=0.47.0, <0.47.1
>=0.46.0, <0.46.1
>=0.15.0, <0.15.1
>=0.14.0, <0.14.1
>=0.13.0, <0.13.1
>=0.12.0, <0.12.1
>=0.11.0, <0.11.1
>=0.10.1, <0.10.2
>=0.9.0, <0.9.1
>=0.8.0, <0.8.1
>=0.7.0, <0.7.1
>=0.6.0, <0.6.1
>=0.5.2, <0.5.3
>=0.4.1, <0.4.2
>=0.3.0, <0.3.1
>=0.2.0, <0.2.1
>=0.0.0-0, <0.2.1
>=0.3.0-0, <0.3.1
>=0.4.0-0, <0.5.3
>=0.6.0-0, <0.6.1
>=0.7.0-0, <0.7.1
>=0.8.0-0, <0.8.1
>=0.9.0-0, <0.9.1
>=0.10.0-0, <0.10.2
>=0.11.0-0, <0.11.1
>=0.12.0-0, <0.12.1
>=0.13.0-0, <0.13.1
>=0.14.0-0, <0.14.1
>=0.15.0-0, <0.15.1
>=0.16.0-0, <0.46.1
>=0.47.0-0, <0.47.1
>=0.48.0-0, <0.48.1
>=0.49.0-0, <0.49.1
>=0.50.0-0, <0.50.1
>=0.51.0-0, <0.51.1
>=0.52.0-0, <0.52.1
>=0.53.0-0, <0.53.2
>=0.54.0-0, <0.54.2
>=0.55.0-0, <0.55.1
0.55.1
0.54.2
0.53.2
0.52.1
0.51.1
0.49.1
0.48.1
0.47.1
0.46.1
0.15.1
0.14.1
0.13.1
0.12.1
0.11.1
0.10.2
0.9.1
0.8.1
0.7.1
0.6.1
0.5.3
0.4.2
0.3.1
0.2.1
0.50.1

Affected products

  • awslabs aws-sdk-rust

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.