{"cve":"CVE-2023-30610","nvd":{"published":"2023-04-19T18:15:07.417","modified":"2026-06-17T05:55:07.997","status":"Modified","description":"aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":5.5},"cwes":["CWE-532"],"references":["https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9","https://github.com/awslabs/aws-sdk-rust/security/advisories/GHSA-mjv9-vp6w-3rc9"],"products":["amazon:aws-sigv4"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2023-30610","score":0.00214,"percentile":0.11818,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-mjv9-vp6w-3rc9","url":"https://osv.dev/vulnerability/GHSA-mjv9-vp6w-3rc9","summary":"AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending","modified":"2026-04-06T17:38:55.716713Z","packages":[{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.55.0 <0.55.1"],"fixed":["0.55.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.54.1 <0.54.2"],"fixed":["0.54.2"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.53.1 <0.53.2"],"fixed":["0.53.2"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.52.0 <0.52.1"],"fixed":["0.52.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.51.0 <0.51.1"],"fixed":["0.51.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.49.0 <0.49.1"],"fixed":["0.49.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.48.0 <0.48.1"],"fixed":["0.48.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.47.0 <0.47.1"],"fixed":["0.47.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.46.0 <0.46.1"],"fixed":["0.46.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.15.0 <0.15.1"],"fixed":["0.15.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.14.0 <0.14.1"],"fixed":["0.14.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.13.0 <0.13.1"],"fixed":["0.13.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.12.0 <0.12.1"],"fixed":["0.12.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.11.0 <0.11.1"],"fixed":["0.11.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.10.1 <0.10.2"],"fixed":["0.10.2"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.9.0 <0.9.1"],"fixed":["0.9.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.8.0 <0.8.1"],"fixed":["0.8.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.7.0 <0.7.1"],"fixed":["0.7.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.6.0 <0.6.1"],"fixed":["0.6.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.5.2 <0.5.3"],"fixed":["0.5.3"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.4.1 <0.4.2"],"fixed":["0.4.2"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.3.0 <0.3.1"],"fixed":["0.3.1"]},{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.2.0 <0.2.1"],"fixed":["0.2.1"]}]},{"id":"RUSTSEC-2023-0125","url":"https://osv.dev/vulnerability/RUSTSEC-2023-0125","summary":"Logs AWS credentials when TRACE-level logging is enabled","modified":"2026-10-12T18:00:06.111286050Z","packages":[{"ecosystem":"crates.io","name":"aws-sigv4","purl":"pkg:cargo/aws-sigv4","ranges":[">=0.0.0-0 <0.2.1",">=0.3.0-0 <0.3.1",">=0.4.0-0 <0.5.3",">=0.6.0-0 <0.6.1",">=0.7.0-0 <0.7.1",">=0.8.0-0 <0.8.1",">=0.9.0-0 <0.9.1",">=0.10.0-0 <0.10.2",">=0.11.0-0 <0.11.1",">=0.12.0-0 <0.12.1",">=0.13.0-0 <0.13.1",">=0.14.0-0 <0.14.1",">=0.15.0-0 <0.15.1",">=0.16.0-0 <0.46.1",">=0.47.0-0 <0.47.1",">=0.48.0-0 <0.48.1",">=0.49.0-0 <0.49.1",">=0.50.0-0 <0.50.1",">=0.51.0-0 <0.51.1",">=0.52.0-0 <0.52.1",">=0.53.0-0 <0.53.2",">=0.54.0-0 <0.54.2",">=0.55.0-0 <0.55.1"],"fixed":["0.2.1","0.3.1","0.5.3","0.6.1","0.7.1","0.8.1","0.9.1","0.10.2","0.11.1","0.12.1","0.13.1","0.14.1","0.15.1","0.46.1","0.47.1","0.48.1","0.49.1","0.50.1","0.51.1","0.52.1","0.53.2","0.54.2","0.55.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}