---
id: CVE-2023-30610
aliases:
  - RUSTSEC-2023-0125
  - GHSA-mjv9-vp6w-3rc9
title: Logs AWS credentials when TRACE-level logging is enabled
summary: Logs AWS credentials when TRACE-level logging is enabled
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: aws-sigv4
product: aws-sigv4
ecosystem: rust
affected:
  - 'aws-sigv4 >= 0.55.0-0, < 0.55.1'
patched:
  - aws-sigv4 0.55.1
published: '2023-04-19'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T18:00:06.111286050Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2023-0125'
references:
  - url: 'https://crates.io/crates/aws-sigv4'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2023-0125.html'
  - url: 'https://github.com/smithy-lang/smithy-rs/pull/2562'
tags:
  - osv
  - rust
epss: 0.00214
epssPercentile: 0.11716
ingestedAt: '2026-10-13T11:45:30.164Z'
---

## Overview

aws-sigv4 is a rust library for low level request signing in the aws cloud platform.

The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation.
When debug-formatted, it would include a user's AWS access key, AWS secret key,
and security token in plaintext. When TRACE-level logging is enabled for an SDK,
`SigningParams` is printed, thereby revealing those credentials to anyone
with access to logs.

All users of the AWS SDK for Rust who enabled TRACE-level logging,
either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4`
crate specifically are affected.

This issue has been addressed in a set of new releases.

Users are advised to upgrade.

Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

## Affected packages

- `aws-sigv4 >= 0.55.0-0, < 0.55.1`

## Remediation

Upgrade to a patched release:

- `aws-sigv4 0.55.1`