AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending (GHSA-mjv9-vp6w-3rc9)
Aliases: CVE-2023-30610
Published: 2023-04-26T16:01:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.55.0'}, {'fixed': '0.55.1'}]}], 'versions': ['0.55.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.54.1'}, {'fixed': '0.54.2'}]}], 'versions': ['0.54.1']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.53.1'}, {'fixed': '0.53.2'}]}], 'versions': ['0.53.1']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.52.0'}, {'fixed': '0.52.1'}]}], 'versions': ['0.52.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.51.0'}, {'fixed': '0.51.1'}]}], 'versions': ['0.51.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.49.0'}, {'fixed': '0.49.1'}]}], 'versions': ['0.49.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.48.0'}, {'fixed': '0.48.1'}]}], 'versions': ['0.48.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.47.0'}, {'fixed': '0.47.1'}]}], 'versions': ['0.47.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.46.0'}, {'fixed': '0.46.1'}]}], 'versions': ['0.46.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.15.0'}, {'fixed': '0.15.1'}]}], 'versions': ['0.15.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.14.0'}, {'fixed': '0.14.1'}]}], 'versions': ['0.14.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.0'}, {'fixed': '0.13.1'}]}], 'versions': ['0.13.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.12.0'}, {'fixed': '0.12.1'}]}], 'versions': ['0.12.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.11.0'}, {'fixed': '0.11.1'}]}], 'versions': ['0.11.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.10.1'}, {'fixed': '0.10.2'}]}], 'versions': ['0.10.1']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.0'}, {'fixed': '0.9.1'}]}], 'versions': ['0.9.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '0.8.1'}]}], 'versions': ['0.8.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.7.0'}, {'fixed': '0.7.1'}]}], 'versions': ['0.7.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.6.0'}, {'fixed': '0.6.1'}]}], 'versions': ['0.6.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.5.2'}, {'fixed': '0.5.3'}]}], 'versions': ['0.5.2']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.4.1'}, {'fixed': '0.4.2'}]}], 'versions': ['0.4.1']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.0'}, {'fixed': '0.3.1'}]}], 'versions': ['0.3.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'aws-sigv4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '0.2.1'}]}], 'versions': ['0.2.0']}]

The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.