diff --git a/advisories/github-reviewed/2023/04/GHSA-mjv9-vp6w-3rc9/GHSA-mjv9-vp6w-3rc9.json b/advisories/github-reviewed/2023/04/GHSA-mjv9-vp6w-3rc9/GHSA-mjv9-vp6w-3rc9.json index 213ac866a7c..c758ae1b549 100644 --- a/advisories/github-reviewed/2023/04/GHSA-mjv9-vp6w-3rc9/GHSA-mjv9-vp6w-3rc9.json +++ b/advisories/github-reviewed/2023/04/GHSA-mjv9-vp6w-3rc9/GHSA-mjv9-vp6w-3rc9.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-mjv9-vp6w-3rc9", - "modified": "2023-04-26T16:01:10Z", + "modified": "2025-02-05T16:42:43Z", "published": "2023-04-26T16:01:10Z", "aliases": [ "CVE-2023-30610" ], "summary": "AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending", - "details": "The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.\n\n### Impact\nAll users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.\n\n### Patches\n- Versions >= `0.55.1`\n- `0.54.2`\n- `0.53.2`\n- `0.52.1`\n- `0.51.1`\n- `0.50.1`\n- `0.49.1`\n- `0.48.1`\n- `0.47.1`\n- `0.46.1`\n- `0.15.1`\n- `0.14.1`\n- `0.13.1`\n- `0.12.1`\n- `0.11.1`\n- `0.10.2`\n- `0.9.1`\n- `0.8.1`\n- `0.7.1`\n- `0.6.1`\n- `0.5.3`\n- `0.3.1`\n- `0.2.1`\n\n### Workarounds\nDisable TRACE-level logging for AWS Rust SDK crates.\n", + "details": "The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.\n\n### Impact\nAll users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.\n\n### Patches\n- Versions >= `0.55.1`\n- `0.54.2`\n- `0.53.2`\n- `0.52.1`\n- `0.51.1`\n- `0.50.1`\n- `0.49.1`\n- `0.48.1`\n- `0.47.1`\n- `0.46.1`\n- `0.15.1`\n- `0.14.1`\n- `0.13.1`\n- `0.12.1`\n- `0.11.1`\n- `0.10.2`\n- `0.9.1`\n- `0.8.1`\n- `0.7.1`\n- `0.6.1`\n- `0.5.3`\n- `0.3.1`\n- `0.2.1`\n\n### Workarounds\nDisable TRACE-level logging for AWS Rust SDK crates.", "severity": [ { "type": "CVSS_V3",