CVE-2023-30610 - Vulnerability Details

Vendors	Products
Amazon	Aws-sigv4

Link	Providers
https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-30610", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-04-13T13:25:18.831Z", "datePublished": "2023-04-19T17:18:54.703Z", "dateUpdated": "2025-02-05T14:56:14.270Z"}, "containers": {"cna": {"title": "AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"}], "affected": [{"vendor": "awslabs", "product": "aws-sdk-rust", "versions": [{"version": ">= 0.2.0, < 0.2.1", "status": "affected"}, {"version": ">= 0.3.0, < 0.3.1", "status": "affected"}, {"version": ">= 0.4.1, < 0.4.2", "status": "affected"}, {"version": ">= 0.5.2, < 0.5.3", "status": "affected"}, {"version": ">= 0.6.0, < 0.6.1", "status": "affected"}, {"version": ">= 0.7.0, < 0.7.1", "status": "affected"}, {"version": ">= 0.8.0, < 0.8.1", "status": "affected"}, {"version": ">= 0.9.0, < 0.9.1", "status": "affected"}, {"version": ">= 0.10.1, < 0.10.2", "status": "affected"}, {"version": ">= 0.11.0, < 0.11.1", "status": "affected"}, {"version": ">= 0.12.0, < 0.12.1", "status": "affected"}, {"version": ">= 0.13.0, < 0.13.1", "status": "affected"}, {"version": ">= 0.14.0, < 0.14.1", "status": "affected"}, {"version": ">= 0.15.0, < 0.15.1", "status": "affected"}, {"version": ">= 0.46.0, < 0.46.1", "status": "affected"}, {"version": ">= 0.47.0, < 0.47.1", "status": "affected"}, {"version": ">= 0.48.0, < 0.48.1", "status": "affected"}, {"version": ">= 0.49.0, < 0.49.1", "status": "affected"}, {"version": ">= 0.50.0, < 0.51.1", "status": "affected"}, {"version": ">= 0.52.0, < 0.52.1, ", "status": "affected"}, {"version": ">= 0.53.1, < 0.53.2", "status": "affected"}, {"version": ">= 0.54.1, < 0.54.2", "status": "affected"}, {"version": ">= 0.55.0, < 0.55.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-19T17:18:54.703Z"}, "descriptions": [{"lang": "en", "value": "aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.\n"}], "source": {"advisory": "GHSA-mjv9-vp6w-3rc9", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:28:51.668Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-532", "lang": "en", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-05T14:55:09.619592Z", "id": "CVE-2023-30610", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T14:56:14.270Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-30610 (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

state : PUBLISHED (string)

assignerShortName : GitHub_M (string)

dateReserved : 2023-04-13T13:25:18.831Z (string)

datePublished : 2023-04-19T17:18:54.703Z (string)

dateUpdated : 2025-02-05T14:56:14.270Z (string)

}

containers : { »

cna : { »

title : AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-532 (string)

lang : en (string)

description : CWE-532: Insertion of Sensitive Information into Log File (string)

type : CWE (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

]

references : [ »

0 : { »

name : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

}

]

affected : [ »

0 : { »

vendor : awslabs (string)

product : aws-sdk-rust (string)

versions : [ »

0 : { »

version : >= 0.2.0, < 0.2.1 (string)

status : affected (string)

}

1 : { »

version : >= 0.3.0, < 0.3.1 (string)

status : affected (string)

}

2 : { »

version : >= 0.4.1, < 0.4.2 (string)

status : affected (string)

}

3 : { »

version : >= 0.5.2, < 0.5.3 (string)

status : affected (string)

}

4 : { »

version : >= 0.6.0, < 0.6.1 (string)

status : affected (string)

}

5 : { »

version : >= 0.7.0, < 0.7.1 (string)

status : affected (string)

}

6 : { »

version : >= 0.8.0, < 0.8.1 (string)

status : affected (string)

}

7 : { »

version : >= 0.9.0, < 0.9.1 (string)

status : affected (string)

}

8 : { »

version : >= 0.10.1, < 0.10.2 (string)

status : affected (string)

}

9 : { »

version : >= 0.11.0, < 0.11.1 (string)

status : affected (string)

}

10 : { »

version : >= 0.12.0, < 0.12.1 (string)

status : affected (string)

}

11 : { »

version : >= 0.13.0, < 0.13.1 (string)

status : affected (string)

}

12 : { »

version : >= 0.14.0, < 0.14.1 (string)

status : affected (string)

}

13 : { »

version : >= 0.15.0, < 0.15.1 (string)

status : affected (string)

}

14 : { »

version : >= 0.46.0, < 0.46.1 (string)

status : affected (string)

}

15 : { »

version : >= 0.47.0, < 0.47.1 (string)

status : affected (string)

}

16 : { »

version : >= 0.48.0, < 0.48.1 (string)

status : affected (string)

}

17 : { »

version : >= 0.49.0, < 0.49.1 (string)

status : affected (string)

}

18 : { »

version : >= 0.50.0, < 0.51.1 (string)

status : affected (string)

}

19 : { »

version : >= 0.52.0, < 0.52.1, (string)

status : affected (string)

}

20 : { »

version : >= 0.53.1, < 0.53.2 (string)

status : affected (string)

}

21 : { »

version : >= 0.54.1, < 0.54.2 (string)

status : affected (string)

}

22 : { »

version : >= 0.55.0, < 0.55.1 (string)

status : affected (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2023-04-19T17:18:54.703Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates. (string)

}

]

source : { »

advisory : GHSA-mjv9-vp6w-3rc9 (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T14:28:51.668Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

}

]

}

1 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-532 (string)

lang : en (string)

description : CWE-532 Insertion of Sensitive Information into Log File (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.5 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-02-05T14:55:09.619592Z (string)

id : CVE-2023-30610 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-05T14:56:14.270Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "name": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T14:28:51.668Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-30610", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-05T14:55:09.619592Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532 Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-05T14:56:07.615Z"}}], "cna": {"title": "AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending", "source": {"advisory": "GHSA-mjv9-vp6w-3rc9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "awslabs", "product": "aws-sdk-rust", "versions": [{"status": "affected", "version": ">= 0.2.0, < 0.2.1"}, {"status": "affected", "version": ">= 0.3.0, < 0.3.1"}, {"status": "affected", "version": ">= 0.4.1, < 0.4.2"}, {"status": "affected", "version": ">= 0.5.2, < 0.5.3"}, {"status": "affected", "version": ">= 0.6.0, < 0.6.1"}, {"status": "affected", "version": ">= 0.7.0, < 0.7.1"}, {"status": "affected", "version": ">= 0.8.0, < 0.8.1"}, {"status": "affected", "version": ">= 0.9.0, < 0.9.1"}, {"status": "affected", "version": ">= 0.10.1, < 0.10.2"}, {"status": "affected", "version": ">= 0.11.0, < 0.11.1"}, {"status": "affected", "version": ">= 0.12.0, < 0.12.1"}, {"status": "affected", "version": ">= 0.13.0, < 0.13.1"}, {"status": "affected", "version": ">= 0.14.0, < 0.14.1"}, {"status": "affected", "version": ">= 0.15.0, < 0.15.1"}, {"status": "affected", "version": ">= 0.46.0, < 0.46.1"}, {"status": "affected", "version": ">= 0.47.0, < 0.47.1"}, {"status": "affected", "version": ">= 0.48.0, < 0.48.1"}, {"status": "affected", "version": ">= 0.49.0, < 0.49.1"}, {"status": "affected", "version": ">= 0.50.0, < 0.51.1"}, {"status": "affected", "version": ">= 0.52.0, < 0.52.1, "}, {"status": "affected", "version": ">= 0.53.1, < 0.53.2"}, {"status": "affected", "version": ">= 0.54.1, < 0.54.2"}, {"status": "affected", "version": ">= 0.55.0, < 0.55.1"}]}], "references": [{"url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "name": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-19T17:18:54.703Z"}}}, "cveMetadata": {"cveId": "CVE-2023-30610", "state": "PUBLISHED", "dateUpdated": "2025-02-05T14:56:14.270Z", "dateReserved": "2023-04-13T13:25:18.831Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-19T17:18:54.703Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

name : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T14:28:51.668Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.5 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-30610 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-02-05T14:55:09.619592Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-532 (string)

description : CWE-532 Insertion of Sensitive Information into Log File (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-05T14:56:07.615Z (string)

}

]

cna : { »

title : AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending (string)

source : { »

advisory : GHSA-mjv9-vp6w-3rc9 (string)

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.5 (number)

attackVector : LOCAL (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

]

affected : [ »

0 : { »

vendor : awslabs (string)

product : aws-sdk-rust (string)

versions : [ »

0 : { »

status : affected (string)

version : >= 0.2.0, < 0.2.1 (string)

}

1 : { »

status : affected (string)

version : >= 0.3.0, < 0.3.1 (string)

}

2 : { »

status : affected (string)

version : >= 0.4.1, < 0.4.2 (string)

}

3 : { »

status : affected (string)

version : >= 0.5.2, < 0.5.3 (string)

}

4 : { »

status : affected (string)

version : >= 0.6.0, < 0.6.1 (string)

}

5 : { »

status : affected (string)

version : >= 0.7.0, < 0.7.1 (string)

}

6 : { »

status : affected (string)

version : >= 0.8.0, < 0.8.1 (string)

}

7 : { »

status : affected (string)

version : >= 0.9.0, < 0.9.1 (string)

}

8 : { »

status : affected (string)

version : >= 0.10.1, < 0.10.2 (string)

}

9 : { »

status : affected (string)

version : >= 0.11.0, < 0.11.1 (string)

}

10 : { »

status : affected (string)

version : >= 0.12.0, < 0.12.1 (string)

}

11 : { »

status : affected (string)

version : >= 0.13.0, < 0.13.1 (string)

}

12 : { »

status : affected (string)

version : >= 0.14.0, < 0.14.1 (string)

}

13 : { »

status : affected (string)

version : >= 0.15.0, < 0.15.1 (string)

}

14 : { »

status : affected (string)

version : >= 0.46.0, < 0.46.1 (string)

}

15 : { »

status : affected (string)

version : >= 0.47.0, < 0.47.1 (string)

}

16 : { »

status : affected (string)

version : >= 0.48.0, < 0.48.1 (string)

}

17 : { »

status : affected (string)

version : >= 0.49.0, < 0.49.1 (string)

}

18 : { »

status : affected (string)

version : >= 0.50.0, < 0.51.1 (string)

}

19 : { »

status : affected (string)

version : >= 0.52.0, < 0.52.1, (string)

}

20 : { »

status : affected (string)

version : >= 0.53.1, < 0.53.2 (string)

}

21 : { »

status : affected (string)

version : >= 0.54.1, < 0.54.2 (string)

}

22 : { »

status : affected (string)

version : >= 0.55.0, < 0.55.1 (string)

}

]

}

]

references : [ »

0 : { »

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

name : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-532 (string)

description : CWE-532: Insertion of Sensitive Information into Log File (string)

}

]

}

]

providerMetadata : { »

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

dateUpdated : 2023-04-19T17:18:54.703Z (string)

}

cveMetadata : { »

cveId : CVE-2023-30610 (string)

state : PUBLISHED (string)

dateUpdated : 2025-02-05T14:56:14.270Z (string)

dateReserved : 2023-04-13T13:25:18.831Z (string)

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

datePublished : 2023-04-19T17:18:54.703Z (string)

assignerShortName : GitHub_M (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.2.0:*:*:*:*:rust:*:*", "matchCriteriaId": "12881A87-AB1E-44AB-8AF9-0AFB945CC2FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.3.0:*:*:*:*:rust:*:*", "matchCriteriaId": "E586C004-6528-4015-806E-D4559F7BAFE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.4.1:*:*:*:*:rust:*:*", "matchCriteriaId": "28CC8686-3C04-44BE-8897-55FFD70069FA", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.5.2:*:*:*:*:rust:*:*", "matchCriteriaId": "BBB473F8-1EA4-41A3-9B65-8EDBB59BD0ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.6.0:*:*:*:*:rust:*:*", "matchCriteriaId": "9853C3AA-75C6-432D-9587-ACF806F92F5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.7.0:*:*:*:*:rust:*:*", "matchCriteriaId": "27DEE720-C938-471F-BB6A-270CE15A99CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.8.0:*:*:*:*:rust:*:*", "matchCriteriaId": "2AA5BC01-D2D4-43C1-AFF5-46CD7D8556A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.9.0:*:*:*:*:rust:*:*", "matchCriteriaId": "BD389AD3-0E0D-4B6B-9F8F-715332E77DEC", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.10.1:*:*:*:*:rust:*:*", "matchCriteriaId": "1AE0FC7F-8614-487E-BE30-8445F083ABE3", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.11.0:*:*:*:*:rust:*:*", "matchCriteriaId": "64F86FEC-F13A-491B-A28D-1818A071B466", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.12.0:*:*:*:*:rust:*:*", "matchCriteriaId": "1E6FEB66-EE8A-4C83-BB9D-4F9A1697C8A9", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.13.0:*:*:*:*:rust:*:*", "matchCriteriaId": "77B07C90-CA86-43FA-9664-7623A19A4172", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.14.0:*:*:*:*:rust:*:*", "matchCriteriaId": "4B99DFB4-E7BA-4C86-97CB-E8E092CCBEB8", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.15.0:*:*:*:*:rust:*:*", "matchCriteriaId": "74F2AF3D-ECCA-4CD3-9835-CB56B29699B0", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.46.0:*:*:*:*:rust:*:*", "matchCriteriaId": "8BA0C6BC-7489-40CE-B60F-67AF597FF74D", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.47.0:*:*:*:*:rust:*:*", "matchCriteriaId": "DF08381B-5513-4001-A6C5-398CC5E0A84F", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.48.0:*:*:*:*:rust:*:*", "matchCriteriaId": "630EA797-C5DF-42F3-921F-951D59581589", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.49.0:*:*:*:*:rust:*:*", "matchCriteriaId": "62C594E6-6276-472B-B668-5793A08D9618", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.50.0:*:*:*:*:rust:*:*", "matchCriteriaId": "BC881298-2EAD-40D7-82D7-69FAA11942DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.51.0:*:*:*:*:rust:*:*", "matchCriteriaId": "B32D4B7D-5D29-4BD3-B9AD-43D070F3EA17", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.52.0:*:*:*:*:rust:*:*", "matchCriteriaId": "DDECA839-CF7C-48A1-92E9-95B05DA15E15", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.53.1:*:*:*:*:rust:*:*", "matchCriteriaId": "D77B3A68-5C22-4C48-8508-CE457D73C14C", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.54.1:*:*:*:*:rust:*:*", "matchCriteriaId": "6A83D537-7D99-4F10-BE79-9379F374EA3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:amazon:aws-sigv4:0.55.0:*:*:*:*:rust:*:*", "matchCriteriaId": "5C3532CD-3566-40E7-9A9C-78B02C48BE99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.\n"}], "id": "CVE-2023-30610", "lastModified": "2025-02-05T15:15:19.460", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-04-19T18:15:07.417", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-532"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.2.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 12881A87-AB1E-44AB-8AF9-0AFB945CC2FB (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.3.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : E586C004-6528-4015-806E-D4559F7BAFE9 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.4.1:*:*:*:*:rust:*:* (string)

matchCriteriaId : 28CC8686-3C04-44BE-8897-55FFD70069FA (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.5.2:*:*:*:*:rust:*:* (string)

matchCriteriaId : BBB473F8-1EA4-41A3-9B65-8EDBB59BD0ED (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.6.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 9853C3AA-75C6-432D-9587-ACF806F92F5C (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.7.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 27DEE720-C938-471F-BB6A-270CE15A99CD (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.8.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 2AA5BC01-D2D4-43C1-AFF5-46CD7D8556A7 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.9.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : BD389AD3-0E0D-4B6B-9F8F-715332E77DEC (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.10.1:*:*:*:*:rust:*:* (string)

matchCriteriaId : 1AE0FC7F-8614-487E-BE30-8445F083ABE3 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.11.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 64F86FEC-F13A-491B-A28D-1818A071B466 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.12.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 1E6FEB66-EE8A-4C83-BB9D-4F9A1697C8A9 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.13.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 77B07C90-CA86-43FA-9664-7623A19A4172 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.14.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 4B99DFB4-E7BA-4C86-97CB-E8E092CCBEB8 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.15.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 74F2AF3D-ECCA-4CD3-9835-CB56B29699B0 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.46.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 8BA0C6BC-7489-40CE-B60F-67AF597FF74D (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.47.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : DF08381B-5513-4001-A6C5-398CC5E0A84F (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.48.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 630EA797-C5DF-42F3-921F-951D59581589 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.49.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 62C594E6-6276-472B-B668-5793A08D9618 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.50.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : BC881298-2EAD-40D7-82D7-69FAA11942DD (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.51.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : B32D4B7D-5D29-4BD3-B9AD-43D070F3EA17 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.52.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : DDECA839-CF7C-48A1-92E9-95B05DA15E15 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.53.1:*:*:*:*:rust:*:* (string)

matchCriteriaId : D77B3A68-5C22-4C48-8508-CE457D73C14C (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.54.1:*:*:*:*:rust:*:* (string)

matchCriteriaId : 6A83D537-7D99-4F10-BE79-9379F374EA3A (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:amazon:aws-sigv4:0.55.0:*:*:*:*:rust:*:* (string)

matchCriteriaId : 5C3532CD-3566-40E7-9A9C-78B02C48BE99 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates. (string)

}

]

id : CVE-2023-30610 (string)

lastModified : 2025-02-05T15:15:19.460 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : security-advisories@github.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

2 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 3.6 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-04-19T18:15:07.417 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9 (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-532 (string)

}

]

source : security-advisories@github.com (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-532 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object