{"id":"GHSA-fc4h-xcf3-qj5f","aliases":["RUSTSEC-2022-0062"],"status":"published","title":"matrix-sdk 0.6.0 logs access tokens","description":"When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-10-24T12:00:00Z","modified":"2023-11-08T04:18:56Z","fixes":[{"ecosystem":"crates.io","package":"matrix-sdk","fixed_in":["0.6.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"matrix-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.6.0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"matrix-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.6.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"matrix-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0.6.0"},{"fixed":"0.6.2"}]}]}],"references":[{"url":"https://github.com/matrix-org/matrix-rust-sdk/issues/1110","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0062.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-fc4h-xcf3-qj5f"},{"url":"https://github.com/matrix-org/matrix-rust-sdk","tags":["package"]},{"url":"https://crates.io/crates/matrix-sdk","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-fc4h-xcf3-qj5f","title":"matrix-sdk 0.6.0 logs access tokens","description":"When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.\n","status":"published","published":"2022-10-25T20:22:19Z","modified":"2023-01-07T05:02:04Z","updated_at":"2026-11-02T14:36:01.39976Z"}],"osv":[{"id":"GHSA-fc4h-xcf3-qj5f","title":"matrix-sdk 0.6.0 logs access tokens","description":"When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.\n","status":"published","published":"2022-10-25T20:22:19Z","modified":"2023-11-08T04:18:56.332015Z","updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"RUSTSEC-2022-0062","title":"matrix-sdk 0.6.0 logs access tokens","description":"When sending Matrix requests using an affected version of `matrix-sdk` in an application that\nwrites logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as\n`tracing_subscriber`s default text output from the `fmt` module), these logs will contain the\nuser's access token.","status":"published","published":"2022-10-24T12:00:00Z","modified":"2023-11-08T04:18:56.332015Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}