CVE-2023-30610: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

April 26, 2023

The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user’s AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.

References

Detect and mitigate CVE-2023-30610 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions starting from 0.2.0 before 0.2.1, version 0.2.0, all versions starting from 0.3.0 before 0.3.1, version 0.3.0, all versions starting from 0.4.1 before 0.4.2, version 0.4.1, all versions starting from 0.5.2 before 0.5.3, version 0.5.2, all versions starting from 0.6.0 before 0.6.1, version 0.6.0, all versions starting from 0.7.0 before 0.7.1, version 0.7.0, all versions starting from 0.8.0 before 0.8.1, version 0.8.0, all versions starting from 0.9.0 before 0.9.1, version 0.9.0, all versions starting from 0.10.1 before 0.10.2, version 0.10.1, all versions starting from 0.11.0 before 0.11.1, version 0.11.0, all versions starting from 0.12.0 before 0.12.1, version 0.12.0, all versions starting from 0.13.0 before 0.13.1, version 0.13.0, all versions starting from 0.14.0 before 0.14.1, version 0.14.0, all versions starting from 0.15.0 before 0.15.1, version 0.15.0, all versions starting from 0.46.0 before 0.46.1, version 0.46.0, all versions starting from 0.47.0 before 0.47.1, version 0.47.0, all versions starting from 0.48.0 before 0.48.1, version 0.48.0, all versions starting from 0.49.0 before 0.49.1, version 0.49.0, all versions starting from 0.51.0 before 0.51.1, version 0.51.0, all versions starting from 0.52.0 before 0.52.1, version 0.52.0, all versions starting from 0.53.1 before 0.53.2, version 0.53.1, all versions starting from 0.54.1 before 0.54.2, version 0.54.1, all versions starting from 0.55.0 before 0.55.1, version 0.55.0