Read the docs
TI-2023-14426 Aliases CVE-2023-30610GHSA-mjv9-vp6w-3rc9

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00214 11th percentileScored 2026-11-07
Fix Fixed aws-sdk-rust (awslabs): 0.2.1, 0.3.1, 0.4.2 +19aws-sigv4 (crates.io): 0.55.1, 0.54.2, 0.53.2 +20

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AWSaws-sdk-rust0.2.0 to before 0.2.1; 0.3.0 to before 0.3.1; 0.4.1 to before 0.4.2; 0.5.2 to before 0.5.3; 0.6.0 to before 0.6.1; 0.7.0 to before 0.7.1; 0.8.0 to before 0.8.1; 0.9.0 to before 0.9.1; 0.10.1 to before 0.10.2; 0.11.0 to before 0.11.1; 0.12.0 to before 0.12.1; 0.13.0 to before 0.13.1; 0.14.0 to before 0.14.1; 0.15.0 to before 0.15.1; 0.46.0 to before 0.46.1; 0.47.0 to before 0.47.1; 0.48.0 to before 0.48.1; 0.49.0 to before 0.49.1; 0.50.0 to before 0.51.1; >= 0.52.0, < 0.52.1, ; 0.53.1 to before 0.53.2; 0.54.1 to before 0.54.2; 0.55.0 to before 0.55.10.2.1, 0.3.1, 0.4.2, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.51.1, 0.53.2, 0.54.2, 0.55.1Patch availableCNA
—aws-sigv4 (crates.io)0.55.0 to before 0.55.10.55.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.54.1 to before 0.54.20.54.2Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.53.1 to before 0.53.20.53.2Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.52.0 to before 0.52.10.52.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.51.0 to before 0.51.10.51.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.49.0 to before 0.49.10.49.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.48.0 to before 0.48.10.48.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.47.0 to before 0.47.10.47.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.46.0 to before 0.46.10.46.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.15.0 to before 0.15.10.15.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.14.0 to before 0.14.10.14.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.13.0 to before 0.13.10.13.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.12.0 to before 0.12.10.12.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.11.0 to before 0.11.10.11.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.10.1 to before 0.10.20.10.2Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.9.0 to before 0.9.10.9.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.8.0 to before 0.8.10.8.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.7.0 to before 0.7.10.7.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.6.0 to before 0.6.10.6.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.5.2 to before 0.5.30.5.3Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.4.1 to before 0.4.20.4.2Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.3.0 to before 0.3.10.3.1Patch availableGHSA-mjv9-vp6w-3rc9
—aws-sigv4 (crates.io)0.2.0 to before 0.2.10.2.1Patch availableGHSA-mjv9-vp6w-3rc9
  • aws-sdk-rust VendorAWS Affected 0.2.0 to before 0.2.1; 0.3.0 to before 0.3.1; 0.4.1 to before 0.4.2; 0.5.2 to before 0.5.3; 0.6.0 to before 0.6.1; 0.7.0 to before 0.7.1; 0.8.0 to before 0.8.1; 0.9.0 to before 0.9.1; 0.10.1 to before 0.10.2; 0.11.0 to before 0.11.1; 0.12.0 to before 0.12.1; 0.13.0 to before 0.13.1; 0.14.0 to before 0.14.1; 0.15.0 to before 0.15.1; 0.46.0 to before 0.46.1; 0.47.0 to before 0.47.1; 0.48.0 to before 0.48.1; 0.49.0 to before 0.49.1; 0.50.0 to before 0.51.1; >= 0.52.0, < 0.52.1, ; 0.53.1 to before 0.53.2; 0.54.1 to before 0.54.2; 0.55.0 to before 0.55.1 Fixed in 0.2.1, 0.3.1, 0.4.2, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.51.1, 0.53.2, 0.54.2, 0.55.1 Patch available CNA
  • aws-sigv4 (crates.io) Vendor— Affected 0.55.0 to before 0.55.1 Fixed in 0.55.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.54.1 to before 0.54.2 Fixed in 0.54.2 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.53.1 to before 0.53.2 Fixed in 0.53.2 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.52.0 to before 0.52.1 Fixed in 0.52.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.51.0 to before 0.51.1 Fixed in 0.51.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.49.0 to before 0.49.1 Fixed in 0.49.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.48.0 to before 0.48.1 Fixed in 0.48.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.47.0 to before 0.47.1 Fixed in 0.47.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.46.0 to before 0.46.1 Fixed in 0.46.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.15.0 to before 0.15.1 Fixed in 0.15.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.14.0 to before 0.14.1 Fixed in 0.14.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.13.0 to before 0.13.1 Fixed in 0.13.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.12.0 to before 0.12.1 Fixed in 0.12.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.11.0 to before 0.11.1 Fixed in 0.11.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.10.1 to before 0.10.2 Fixed in 0.10.2 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.9.0 to before 0.9.1 Fixed in 0.9.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.8.0 to before 0.8.1 Fixed in 0.8.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.7.0 to before 0.7.1 Fixed in 0.7.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.6.0 to before 0.6.1 Fixed in 0.6.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.5.2 to before 0.5.3 Fixed in 0.5.3 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.4.1 to before 0.4.2 Fixed in 0.4.2 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.3.0 to before 0.3.1 Fixed in 0.3.1 Patch available GHSA-mjv9-vp6w-3rc9
  • aws-sigv4 (crates.io) Vendor— Affected 0.2.0 to before 0.2.1 Fixed in 0.2.1 Patch available GHSA-mjv9-vp6w-3rc9

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:amazon:aws-sigv4:0.2.0:*:*:*:*:rust:*:*0.2.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.3.0:*:*:*:*:rust:*:*0.3.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.4.1:*:*:*:*:rust:*:*0.4.1VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.5.2:*:*:*:*:rust:*:*0.5.2VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.6.0:*:*:*:*:rust:*:*0.6.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.7.0:*:*:*:*:rust:*:*0.7.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.8.0:*:*:*:*:rust:*:*0.8.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.9.0:*:*:*:*:rust:*:*0.9.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.10.1:*:*:*:*:rust:*:*0.10.1VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.11.0:*:*:*:*:rust:*:*0.11.0VulnerableAWS
  • cpe:2.3:a:amazon:aws-sigv4:0.2.0:*:*:*:*:rust:*:* Versions 0.2.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.3.0:*:*:*:*:rust:*:* Versions 0.3.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.4.1:*:*:*:*:rust:*:* Versions 0.4.1 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.5.2:*:*:*:*:rust:*:* Versions 0.5.2 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.6.0:*:*:*:*:rust:*:* Versions 0.6.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.7.0:*:*:*:*:rust:*:* Versions 0.7.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.8.0:*:*:*:*:rust:*:* Versions 0.8.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.9.0:*:*:*:*:rust:*:* Versions 0.9.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.10.1:*:*:*:*:rust:*:* Versions 0.10.1 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.11.0:*:*:*:*:rust:*:* Versions 0.11.0 Vulnerable ·AWS
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:amazon:aws-sigv4:0.12.0:*:*:*:*:rust:*:*0.12.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.13.0:*:*:*:*:rust:*:*0.13.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.14.0:*:*:*:*:rust:*:*0.14.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.15.0:*:*:*:*:rust:*:*0.15.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.46.0:*:*:*:*:rust:*:*0.46.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.47.0:*:*:*:*:rust:*:*0.47.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.48.0:*:*:*:*:rust:*:*0.48.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.49.0:*:*:*:*:rust:*:*0.49.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.50.0:*:*:*:*:rust:*:*0.50.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.51.0:*:*:*:*:rust:*:*0.51.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.52.0:*:*:*:*:rust:*:*0.52.0VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.53.1:*:*:*:*:rust:*:*0.53.1VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.54.1:*:*:*:*:rust:*:*0.54.1VulnerableAWS
cpe:2.3:a:amazon:aws-sigv4:0.55.0:*:*:*:*:rust:*:*0.55.0VulnerableAWS
  • cpe:2.3:a:amazon:aws-sigv4:0.12.0:*:*:*:*:rust:*:* Versions 0.12.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.13.0:*:*:*:*:rust:*:* Versions 0.13.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.14.0:*:*:*:*:rust:*:* Versions 0.14.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.15.0:*:*:*:*:rust:*:* Versions 0.15.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.46.0:*:*:*:*:rust:*:* Versions 0.46.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.47.0:*:*:*:*:rust:*:* Versions 0.47.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.48.0:*:*:*:*:rust:*:* Versions 0.48.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.49.0:*:*:*:*:rust:*:* Versions 0.49.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.50.0:*:*:*:*:rust:*:* Versions 0.50.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.51.0:*:*:*:*:rust:*:* Versions 0.51.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.52.0:*:*:*:*:rust:*:* Versions 0.52.0 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.53.1:*:*:*:*:rust:*:* Versions 0.53.1 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.54.1:*:*:*:*:rust:*:* Versions 0.54.1 Vulnerable ·AWS
  • cpe:2.3:a:amazon:aws-sigv4:0.55.0:*:*:*:*:rust:*:* Versions 0.55.0 Vulnerable ·AWS

Remediation

  • Fix · CNA aws-sdk-rust (awslabs) Fixed in 0.2.1, 0.3.1, 0.4.2, 0.5.3, 0.6.1, 0.7.1, 0.8.1, 0.9.1, 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.51.1, 0.53.2, 0.54.2, 0.55.1
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.55.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.54.2 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.53.2 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.52.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.51.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.49.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.48.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.47.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.46.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.15.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.14.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.13.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.12.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.11.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.10.2 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.9.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.8.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.7.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.6.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.5.3 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.4.2 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.3.1 Advisory →
  • Fix · GHSA-mjv9-vp6w-3rc9 aws-sigv4 (crates.io) Fixed in 0.2.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-30610
  2. 2026-10-03 Alias added: GHSA-mjv9-vp6w-3rc9

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences