Skip to content
Fencer Intel
medium 5.5

CVE-2023-30610 json

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

published 3y ago modified last mo. also GHSA-mjv9-vp6w-3rc9 , RUSTSEC-2023-0125 , EUVD-2023-1355

cvss
5.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Patch / fix

  • crates.io aws-sigv4 0.2.1, 0.3.1, 0.4.2, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.50.1, 0.51.1, 0.52.1, 0.53.2, 0.54.2, 0.55.1

Is CVE-2023-30610 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CISA ADP 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
OSV 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
crates.io aws-sigv4
>=0.55.0, <0.55.1
>=0.54.1, <0.54.2
>=0.53.1, <0.53.2
>=0.52.0, <0.52.1
>=0.51.0, <0.51.1
>=0.49.0, <0.49.1
>=0.48.0, <0.48.1
>=0.47.0, <0.47.1
>=0.46.0, <0.46.1
>=0.15.0, <0.15.1
>=0.14.0, <0.14.1
>=0.13.0, <0.13.1
>=0.12.0, <0.12.1
>=0.11.0, <0.11.1
>=0.10.1, <0.10.2
>=0.9.0, <0.9.1
>=0.8.0, <0.8.1
>=0.7.0, <0.7.1
>=0.6.0, <0.6.1
>=0.5.2, <0.5.3
>=0.4.1, <0.4.2
>=0.3.0, <0.3.1
>=0.2.0, <0.2.1
>=0.0.0-0, <0.2.1
>=0.3.0-0, <0.3.1
>=0.4.0-0, <0.5.3
>=0.6.0-0, <0.6.1
>=0.7.0-0, <0.7.1
>=0.8.0-0, <0.8.1
>=0.9.0-0, <0.9.1
>=0.10.0-0, <0.10.2
>=0.11.0-0, <0.11.1
>=0.12.0-0, <0.12.1
>=0.13.0-0, <0.13.1
>=0.14.0-0, <0.14.1
>=0.15.0-0, <0.15.1
>=0.16.0-0, <0.46.1
>=0.47.0-0, <0.47.1
>=0.48.0-0, <0.48.1
>=0.49.0-0, <0.49.1
>=0.50.0-0, <0.50.1
>=0.51.0-0, <0.51.1
>=0.52.0-0, <0.52.1
>=0.53.0-0, <0.53.2
>=0.54.0-0, <0.54.2
>=0.55.0-0, <0.55.1
0.55.1
0.54.2
0.53.2
0.52.1
0.51.1
0.49.1
0.48.1
0.47.1
0.46.1
0.15.1
0.14.1
0.13.1
0.12.1
0.11.1
0.10.2
0.9.1
0.8.1
0.7.1
0.6.1
0.5.3
0.4.2
0.3.1
0.2.1
0.50.1

Affected products

  • awslabs aws-sdk-rust

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.