cve.bz

CVE-2023-30610

5.5 mediumEPSS 0.2%

Medium (5.5) in amazon aws-sigv4. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in aws-sigv4 0.10.2, 0.11.1, 0.12.1.

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Severity

CVSS 3.1

5.5 medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE
CWE-532
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.55.0 <0.55.10.55.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.54.1 <0.54.20.54.2
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.53.1 <0.53.20.53.2
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.52.0 <0.52.10.52.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.51.0 <0.51.10.51.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.49.0 <0.49.10.49.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.48.0 <0.48.10.48.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.47.0 <0.47.10.47.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.46.0 <0.46.10.46.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.15.0 <0.15.10.15.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.14.0 <0.14.10.14.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.13.0 <0.13.10.13.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.12.0 <0.12.10.12.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.11.0 <0.11.10.11.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.10.1 <0.10.20.10.2
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.9.0 <0.9.10.9.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.8.0 <0.8.10.8.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.7.0 <0.7.10.7.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.6.0 <0.6.10.6.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.5.2 <0.5.30.5.3
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.4.1 <0.4.20.4.2
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.3.0 <0.3.10.3.1
GHSA-mjv9-vp6w-3rc9crates.ioaws-sigv4>=0.2.0 <0.2.10.2.1
RUSTSEC-2023-0125crates.ioaws-sigv4>=0.0.0-0 <0.2.1
>=0.3.0-0 <0.3.1
>=0.4.0-0 <0.5.3
>=0.6.0-0 <0.6.1
>=0.7.0-0 <0.7.1
>=0.8.0-0 <0.8.1
>=0.9.0-0 <0.9.1
>=0.10.0-0 <0.10.2
>=0.11.0-0 <0.11.1
>=0.12.0-0 <0.12.1
>=0.13.0-0 <0.13.1
>=0.14.0-0 <0.14.1
>=0.15.0-0 <0.15.1
>=0.16.0-0 <0.46.1
>=0.47.0-0 <0.47.1
>=0.48.0-0 <0.48.1
>=0.49.0-0 <0.49.1
>=0.50.0-0 <0.50.1
>=0.51.0-0 <0.51.1
>=0.52.0-0 <0.52.1
>=0.53.0-0 <0.53.2
>=0.54.0-0 <0.54.2
>=0.55.0-0 <0.55.1		0.2.1, 0.3.1, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.50.1, 0.51.1, 0.52.1, 0.53.2, 0.54.2, 0.55.1

References

Check your stackJSON