CVE-2023-30610 — Vulnerability in aws-sigv4 — CVE Details

MEDIUM

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Published April 26, 2023Updated April 6, 2026Source: osv

Summary

The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. ### Impact All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically. ### Patches - Versions >= `0.55.1` - `0.54.2` - `0.53.2` - `0.52.1` - `0.51.1` - `0.50.1` - `0.49.1` - `0.48.1` - `0.47.1` - `0.46.1` - `0.15.1` - `0.14.1` - `0.13.1` - `0.12.1` - `0.11.1` - `0.10.2` - `0.9.1` - `0.8.1` - `0.7.1` - `0.6.1` - `0.5.3` - `0.3.1` - `0.2.1` ### Workarounds Disable TRACE-level logging for AWS Rust SDK crates.

Advisory Timeline

First published April 26, 2023 (1265 days ago).
Last revised April 6, 2026 — 1076 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo

Update aws-sigv4 to 0.52.1 or later

cargo update -p aws-sigv4 --precise 0.52.1

Cargo

Update aws-sigv4 to 0.49.1 or later

cargo update -p aws-sigv4 --precise 0.49.1

Cargo

Update aws-sigv4 to 0.55.1 or later

cargo update -p aws-sigv4 --precise 0.55.1

Cargo

Update aws-sigv4 to 0.13.1 or later

cargo update -p aws-sigv4 --precise 0.13.1

Cargo

Update aws-sigv4 to 0.12.1 or later

cargo update -p aws-sigv4 --precise 0.12.1

Cargo

Update aws-sigv4 to 0.5.3 or later

cargo update -p aws-sigv4 --precise 0.5.3

Cargo

Update aws-sigv4 to 0.6.1 or later

cargo update -p aws-sigv4 --precise 0.6.1

Cargo

Update aws-sigv4 to 0.53.2 or later

cargo update -p aws-sigv4 --precise 0.53.2

Cargo

Update aws-sigv4 to 0.10.2 or later

cargo update -p aws-sigv4 --precise 0.10.2

Cargo

Update aws-sigv4 to 0.51.1 or later

cargo update -p aws-sigv4 --precise 0.51.1

Cargo

Update aws-sigv4 to 0.14.1 or later

cargo update -p aws-sigv4 --precise 0.14.1

Cargo

Update aws-sigv4 to 0.4.2 or later

cargo update -p aws-sigv4 --precise 0.4.2

Cargo

Update aws-sigv4 to 0.11.1 or later

cargo update -p aws-sigv4 --precise 0.11.1

Cargo

Update aws-sigv4 to 0.46.1 or later

cargo update -p aws-sigv4 --precise 0.46.1

Cargo

Update aws-sigv4 to 0.3.1 or later

cargo update -p aws-sigv4 --precise 0.3.1

Cargo

Update aws-sigv4 to 0.2.1 or later

cargo update -p aws-sigv4 --precise 0.2.1

Cargo

Update aws-sigv4 to 0.7.1 or later

cargo update -p aws-sigv4 --precise 0.7.1

Cargo

Update aws-sigv4 to 0.9.1 or later

cargo update -p aws-sigv4 --precise 0.9.1

Cargo

Update aws-sigv4 to 0.48.1 or later

cargo update -p aws-sigv4 --precise 0.48.1

Cargo

Update aws-sigv4 to 0.15.1 or later

cargo update -p aws-sigv4 --precise 0.15.1

Cargo

Update aws-sigv4 to 0.54.2 or later

cargo update -p aws-sigv4 --precise 0.54.2

Cargo

Update aws-sigv4 to 0.47.1 or later

cargo update -p aws-sigv4 --precise 0.47.1

Cargo

Update aws-sigv4 to 0.8.1 or later

cargo update -p aws-sigv4 --precise 0.8.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (23)

Affects 1 ecosystem: crates.io (1).

Package	Ecosystem	Affected	Fixed In
aws-sigv4	crates.io	0.52.0	0.52.1
aws-sigv4	crates.io	0.49.0	0.49.1
aws-sigv4	crates.io	0.55.0	0.55.1
aws-sigv4	crates.io	0.13.0	0.13.1
aws-sigv4	crates.io	0.12.0	0.12.1
aws-sigv4	crates.io	0.5.2	0.5.3
aws-sigv4	crates.io	0.6.0	0.6.1
aws-sigv4	crates.io	0.53.1	0.53.2
aws-sigv4	crates.io	0.10.1	0.10.2
aws-sigv4	crates.io	0.51.0	0.51.1
aws-sigv4	crates.io	0.14.0	0.14.1
aws-sigv4	crates.io	0.4.1	0.4.2
aws-sigv4	crates.io	0.11.0	0.11.1
aws-sigv4	crates.io	0.46.0	0.46.1
aws-sigv4	crates.io	0.3.0	0.3.1
aws-sigv4	crates.io	0.2.0	0.2.1
aws-sigv4	crates.io	0.7.0	0.7.1
aws-sigv4	crates.io	0.9.0	0.9.1
aws-sigv4	crates.io	0.48.0	0.48.1
aws-sigv4	crates.io	0.15.0	0.15.1
aws-sigv4	crates.io	0.54.1	0.54.2
aws-sigv4	crates.io	0.47.0	0.47.1
aws-sigv4	crates.io	0.8.0	0.8.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-532
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 5.5 score means for each attack dimension.

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Frequently Asked Questions

What is CVE-2023-30610?: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 5.5/10).
How do I check if my project is affected by CVE-2023-30610?: CVE-2023-30610 affects aws-sigv4. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-30610 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

5.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-mjv9-vp6w-3rc9

RUSTSEC-2023-0125

Related CVEs

CVE-2026-102821
MEDIUM
Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey
CVE-2026-102820
MEDIUM
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies