Every CVE Search/ Get API key

CVE-2023-30610

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

5.5 MediumFix available

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.21%Up 0.2 points since Apr 20, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.5

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Record
CVE-2023-30610
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532, CWE-532
Updated
2026-11-02
EUVDEUVD-2023-1355 5.5

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Record
EUVD-2023-1355
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-mjv9-vp6w-3rc9 5.5

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.

Impact

All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically.

Patches

  • Versions >= 0.55.1
  • 0.54.2
  • 0.53.2
  • 0.52.1
  • 0.51.1
  • 0.50.1
  • 0.49.1
  • 0.48.1
  • 0.47.1
  • 0.46.1
  • 0.15.1
  • 0.14.1
  • 0.13.1
  • 0.12.1
  • 0.11.1
  • 0.10.2
  • 0.9.1
  • 0.8.1
  • 0.7.1
  • 0.6.1
  • 0.5.3
  • 0.3.1
  • 0.2.1

Workarounds

Disable TRACE-level logging for AWS Rust SDK crates.

Record
GHSA-mjv9-vp6w-3rc9
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 5.5

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Record
CVE-2023-30610
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSV 5.5

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Record
CVE-2023-30610
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVGHSA-mjv9-vp6w-3rc9 5.5

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.

Impact

All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically.

Patches

  • Versions >= 0.55.1
  • 0.54.2
  • 0.53.2
  • 0.52.1
  • 0.51.1
  • 0.50.1
  • 0.49.1
  • 0.48.1
  • 0.47.1
  • 0.46.1
  • 0.15.1
  • 0.14.1
  • 0.13.1
  • 0.12.1
  • 0.11.1
  • 0.10.2
  • 0.9.1
  • 0.8.1
  • 0.7.1
  • 0.6.1
  • 0.5.3
  • 0.3.1
  • 0.2.1

Workarounds

Disable TRACE-level logging for AWS Rust SDK crates.

Record
GHSA-mjv9-vp6w-3rc9
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVRUSTSEC-2023-0125 5.5

Logs AWS credentials when TRACE-level logging is enabled

aws-sigv4 is a rust library for low level request signing in the aws cloud platform.

The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.

All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected.

This issue has been addressed in a set of new releases.

Users are advised to upgrade.

Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Record
RUSTSEC-2023-0125
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
aws-sigv4
crates.io
 0.55.0 to 0.55.0
0.55.1
aws-sigv4
crates.io
 0.54.1 to 0.54.1
0.54.2
aws-sigv4
crates.io
 0.53.1 to 0.53.1
0.53.2
aws-sigv4
crates.io
 0.52.0 to 0.52.0
0.52.1
aws-sigv4
crates.io
 0.51.0 to 0.51.0
0.51.1
aws-sigv4
crates.io
 0.49.0 to 0.49.0
0.49.1
aws-sigv4
crates.io
 0.48.0 to 0.48.0
0.48.1
aws-sigv4
crates.io
 0.47.0 to 0.47.0
0.47.1
aws-sigv4
crates.io
 0.46.0 to 0.46.0
0.46.1
aws-sigv4
crates.io
 0.15.0 to 0.15.0
0.15.1
Show 37 moreShow less
Affected packages
PackageAffectedFixed
aws-sigv4
crates.io
 0.14.0 to 0.14.0
0.14.1
aws-sigv4
crates.io
 0.13.0 to 0.13.0
0.13.1
aws-sigv4
crates.io
 0.12.0 to 0.12.0
0.12.1
aws-sigv4
crates.io
 0.11.0 to 0.11.0
0.11.1
aws-sigv4
crates.io
 0.10.1 to 0.10.1
0.10.2
aws-sigv4
crates.io
 0.9.0 to 0.9.0
0.9.1
aws-sigv4
crates.io
 0.8.0 to 0.8.0
0.8.1
aws-sigv4
crates.io
 0.7.0 to 0.7.0
0.7.1
aws-sigv4
crates.io
 0.6.0 to 0.6.0
0.6.1
aws-sigv4
crates.io
 0.5.2 to 0.5.2
0.5.3
aws-sigv4
crates.io
 0.4.1 to 0.4.1
0.4.2
aws-sigv4
crates.io
 0.3.0 to 0.3.0
0.3.1
aws-sigv4
crates.io
 0.2.0 to 0.2.0
0.2.1
aws-sigv4
crates.io
 0.55.0 up to 0.55.1
0.55.1
aws-sigv4
crates.io
 0.54.1 up to 0.54.2
0.54.2
aws-sigv4
crates.io
 0.53.1 up to 0.53.2
0.53.2
aws-sigv4
crates.io
 0.52.0 up to 0.52.1
0.52.1
aws-sigv4
crates.io
 0.51.0 up to 0.51.1
0.51.1
aws-sigv4
crates.io
 0.49.0 up to 0.49.1
0.49.1
aws-sigv4
crates.io
 0.48.0 up to 0.48.1
0.48.1
aws-sigv4
crates.io
 0.47.0 up to 0.47.1
0.47.1
aws-sigv4
crates.io
 0.46.0 up to 0.46.1
0.46.1
aws-sigv4
crates.io
 0.15.0 up to 0.15.1
0.15.1
aws-sigv4
crates.io
 0.14.0 up to 0.14.1
0.14.1
aws-sigv4
crates.io
 0.13.0 up to 0.13.1
0.13.1
aws-sigv4
crates.io
 0.12.0 up to 0.12.1
0.12.1
aws-sigv4
crates.io
 0.11.0 up to 0.11.1
0.11.1
aws-sigv4
crates.io
 0.10.1 up to 0.10.2
0.10.2
aws-sigv4
crates.io
 0.9.0 up to 0.9.1
0.9.1
aws-sigv4
crates.io
 0.8.0 up to 0.8.1
0.8.1
aws-sigv4
crates.io
 0.7.0 up to 0.7.1
0.7.1
aws-sigv4
crates.io
 0.6.0 up to 0.6.1
0.6.1
aws-sigv4
crates.io
 0.5.2 up to 0.5.3
0.5.3
aws-sigv4
crates.io
 0.4.1 up to 0.4.2
0.4.2
aws-sigv4
crates.io
 0.3.0 up to 0.3.1
0.3.1
aws-sigv4
crates.io
 0.2.0 up to 0.2.1
0.2.1
aws-sigv4
crates.io
 0.0.0-0 up to 0.2.1, 0.3.0-0 up to 0.3.1, 0.4.0-0 up to 0.5.3, 0.6.0-0 up to 0.6.1, 0.7.0-0 up to 0.7.1, 0.8.0-0 up to 0.8.1, 0.9.0-0 up to 0.9.1, 0.10.0-0 up to 0.10.2, 0.11.0-0 up to 0.11.1, 0.12.0-0 up to 0.12.1, 0.13.0-0 up to 0.13.1, 0.14.0-0 up to 0.14.1, 0.15.0-0 up to 0.15.1, 0.16.0-0 up to 0.46.1, 0.47.0-0 up to 0.47.1, 0.48.0-0 up to 0.48.1, 0.49.0-0 up to 0.49.1, 0.50.0-0 up to 0.50.1, 0.51.0-0 up to 0.51.1, 0.52.0-0 up to 0.52.1, 0.53.0-0 up to 0.53.2, 0.54.0-0 up to 0.54.2, 0.55.0-0 up to 0.55.1
0.2.10.3.10.5.30.6.10.7.10.8.10.9.10.10.20.11.10.12.10.13.10.14.10.15.10.46.10.47.10.48.10.49.10.50.10.51.10.52.10.53.20.54.20.55.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-30610 is a medium vulnerability (CVSS 5.5) in Amazon Aws-sigv4, published April 19, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in aws-sigv4 0.55.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open