{"id":"CVE-2023-30610","aliases":["RUSTSEC-2023-0125","GHSA-mjv9-vp6w-3rc9"],"title":"Logs AWS credentials when TRACE-level logging is enabled","summary":"Logs AWS credentials when TRACE-level logging is enabled","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"aws-sigv4","product":"aws-sigv4","ecosystem":"rust","affected":["aws-sigv4 >= 0.55.0-0, < 0.55.1"],"patched":["aws-sigv4 0.55.1"],"published":"2023-04-19","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:06.111286050Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2023-0125","references":[{"url":"https://crates.io/crates/aws-sigv4"},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0125.html"},{"url":"https://github.com/smithy-lang/smithy-rs/pull/2562"}],"tags":["osv","rust"],"epss":0.00214,"epssPercentile":0.11716,"ingestedAt":"2026-10-13T11:45:30.164Z","slug":"CVE-2023-30610","body":"## Overview\n\naws-sigv4 is a rust library for low level request signing in the aws cloud platform.\n\nThe `aws_sigv4::SigningParams` struct had a derived `Debug` implementation.\nWhen debug-formatted, it would include a user's AWS access key, AWS secret key,\nand security token in plaintext. When TRACE-level logging is enabled for an SDK,\n`SigningParams` is printed, thereby revealing those credentials to anyone\nwith access to logs.\n\nAll users of the AWS SDK for Rust who enabled TRACE-level logging,\neither globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4`\ncrate specifically are affected.\n\nThis issue has been addressed in a set of new releases.\n\nUsers are advised to upgrade.\n\nUsers unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.\n\n## Affected packages\n\n- `aws-sigv4 >= 0.55.0-0, < 0.55.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `aws-sigv4 0.55.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}