CVE-2024-41178 json
Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files
published 2024-07-23 2 y ago modified 2026-09-10 1 mo ago also GHSA-c2hf-vcmr-qjrf , RUSTSEC-2024-0358 , EUVD-2024-2314
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 53%
- public exploits
- 0
- none known
Summary
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens.
On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html . This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer.
Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue.
Details:
When using AWS WebIdentityTokens with the object_store crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is written to the logs.
Thanks to Paul Hatcherian for reporting this vulnerability
Patch / fix
- crates.io object_store 0.10.2
- apache-arrow openSUSE Tumbleweed 26.0.0-1.1
opensuse advisories openSUSE-SU-2026:12191-1
- github.com/apache/arrow-rs@4978e32 commit
- github.com/apache/arrow-rs#6074 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 3.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
| GitHub | 3.1 | 3.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | object_store | >=0.5.0, <0.10.2 |
0.10.2 |
Affected products
- Apache Software Foundation Apache Arrow Rust Object Store
- apache arrow
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/apache/arrow-rs/pull/6074
web
-
github.com
/apache/arrow-rs/commit/4978e32654235f569062f2cad6c7361e410f1254
web
-
lists.apache.org
/thread/3t0povdppnt2czv6crlsqhvyko93kcrg
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2024/07/23/3
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-41178
advisory
-
github.com
/apache/arrow-rs
package
-
rustsec.org
/advisories/RUSTSEC-2024-0358.html
web, advisory
-
crates.io
/crates/object_store
package
-
openwall.com
/lists/oss-security/2024/07/23/3
web
Sources
- CVE List CVE-2024-41178
- GitHub Advisory GHSA-c2hf-vcmr-qjrf
- NVD CVE-2024-41178
- OSV RUSTSEC-2024-0358
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.