deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-x7fr-pg8f-93f5
Package: sccache (RUST)
Severity: HIGH (CVSS 8.4)
CWE: CWE-426: Untrusted Search Path
Vulnerable versions: < 0.4.0
Patched in: 0.4.0

Summary: sccache vulnerable to privilege escalation if server is run as root

Details:
### Impact

On Linux the `sccache` client can execute arbitrary code with the privileges of a local `sccache` server, by preloading the code in a shared library passed to `LD_PRELOAD`.

If the server is run as root (which is the default when installing the [snap package](https://snapcraft.io/sccache)), this means a user running the `sccache` client can get root privileges.


### Patches
Upgrade to 0.4.0

### Workarounds
Don't run sccache server as root. 

###  GitHub Security Lab number

GHSL-2023-046
GitHub Security Advisory: GHSA-qwhm-h7v3-mrjx
Package: ntpd (RUST)
Severity: HIGH (CVSS 7.5)
CWE: CWE-130: Improper Handling of Length Parameter Inconsistency
Vulnerable versions: >= 0.3.0, < 0.3.3
Patched in: 0.3.3

Summary: Improper handling of NTS cookie length that could crash the ntpd-rs server

Details:
### Impact
ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS packets.

ntpd-rs running purely as an ntp client is not affected.

### Patches
The issue was caused by improper slice indexing. The indexing operations were replaced by safer alternatives that do not crash the ntpd-rs server process but instead properly handle the error condition. A patch was released in version 0.3.3

### Workarounds
ntpd-rs running purely as an ntp client is not affected. By default, ntpd-rs packages are not configured to run as a server.

For machines where serving the time is required, there is no known workaround. Users are recommended to upgrade ntpd-rs as soon as possible.

### References
https://github.com/pendulum-project/ntpd-rs/pull/752

We would like to thank @mlichvar for identifying this issue
GitHub Security Advisory: GHSA-mphm-gqh9-q59x
Package: microbin (RUST)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 1.2.1
Patched in: 1.2.1

Summary: Stored cross site scripting in Microbin

Details:
A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
GitHub Security Advisory: GHSA-c25x-cm9x-qqgx
Package: deno_runtime (RUST)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write
Vulnerable versions: = 0.102.0
Patched in: 0.103.0

Summary: Deno improperly handles resizable ArrayBuffer

Details:
### Impact

[Resizable ArrayBuffers](https://github.com/tc39/proposal-resizablearraybuffer) passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.

It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.

Deno Deploy users are not affected.

### Patches

The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.

### Workarounds

Upgrade to Deno 1.32.1, or run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
GitHub Security Advisory: GHSA-c25x-cm9x-qqgx
Package: serde_v8 (RUST)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write
Vulnerable versions: = 0.87.0
Patched in: 0.88.0

Summary: Deno improperly handles resizable ArrayBuffer

Details:
### Impact

[Resizable ArrayBuffers](https://github.com/tc39/proposal-resizablearraybuffer) passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.

It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.

Deno Deploy users are not affected.

### Patches

The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.

### Workarounds

Upgrade to Deno 1.32.1, or run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
GitHub Security Advisory: GHSA-c25x-cm9x-qqgx
Package: Deno (RUST)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-125: Out-of-bounds Read, CWE-787: Out-of-bounds Write
Vulnerable versions: = 1.32.0
Patched in: 1.32.1

Summary: Deno improperly handles resizable ArrayBuffer

Details:
### Impact

[Resizable ArrayBuffers](https://github.com/tc39/proposal-resizablearraybuffer) passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.

It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.

Deno Deploy users are not affected.

### Patches

The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.

### Workarounds

Upgrade to Deno 1.32.1, or run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
GitHub Security Advisory: GHSA-4wm2-cwcf-wwvp
Package: tauri (RUST)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.2.0, < 1.2.5
Patched in: 1.2.5

Summary: Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

Details:
### Impact
The Tauri IPC is usually strictly isolated from external websites but the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect[^open-redirect].

This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands.

### Patches
This issue has been patched in the latest release and was backported to all previous `1.x` releases.

### Workarounds
Prevent arbitrary input in redirect features. Only allow trusted websites access to the IPC.

### References

The feature to enable this behavior in a more constrained way was introduced in the `1.3` release and documentation around this can be found in the [documentation](https://tauri.app/v1/api/config/#securityconfig.dangerousremotedomainipcaccess).

[^open-redirect]: [https://en.wikipedia.org/wiki/Open_redirect](https://en.wikipedia.org/wiki/Open_redirect)
GitHub Security Advisory: GHSA-4wm2-cwcf-wwvp
Package: tauri (RUST)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.1.0, < 1.1.4
Patched in: 1.1.4

Summary: Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

Details:
### Impact
The Tauri IPC is usually strictly isolated from external websites but the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect[^open-redirect].

This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands.

### Patches
This issue has been patched in the latest release and was backported to all previous `1.x` releases.

### Workarounds
Prevent arbitrary input in redirect features. Only allow trusted websites access to the IPC.

### References

The feature to enable this behavior in a more constrained way was introduced in the `1.3` release and documentation around this can be found in the [documentation](https://tauri.app/v1/api/config/#securityconfig.dangerousremotedomainipcaccess).

[^open-redirect]: [https://en.wikipedia.org/wiki/Open_redirect](https://en.wikipedia.org/wiki/Open_redirect)
GitHub Security Advisory: GHSA-4wm2-cwcf-wwvp
Package: tauri (RUST)
Severity: MODERATE (CVSS 4.8)
CWE: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.0.0, < 1.0.9
Patched in: 1.0.9

Summary: Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites

Details:
### Impact
The Tauri IPC is usually strictly isolated from external websites but the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect[^open-redirect].

This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands.

### Patches
This issue has been patched in the latest release and was backported to all previous `1.x` releases.

### Workarounds
Prevent arbitrary input in redirect features. Only allow trusted websites access to the IPC.

### References

The feature to enable this behavior in a more constrained way was introduced in the `1.3` release and documentation around this can be found in the [documentation](https://tauri.app/v1/api/config/#securityconfig.dangerousremotedomainipcaccess).

[^open-redirect]: [https://en.wikipedia.org/wiki/Open_redirect](https://en.wikipedia.org/wiki/Open_redirect)
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.2.0
Patched in: 0.2.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.3.0
Patched in: 0.3.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.4.1
Patched in: 0.4.2

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.5.2
Patched in: 0.5.3

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.6.0
Patched in: 0.6.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.7.0
Patched in: 0.7.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.8.0
Patched in: 0.8.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.9.0
Patched in: 0.9.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.10.1
Patched in: 0.10.2

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.11.0
Patched in: 0.11.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.12.0
Patched in: 0.12.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.
GitHub Security Advisory: GHSA-mjv9-vp6w-3rc9
Package: aws-sigv4 (RUST)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: = 0.13.0
Patched in: 0.13.1

Summary: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

Details:
The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs.

### Impact
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically.

### Patches
- Versions >= `0.55.1`
- `0.54.2`
- `0.53.2`
- `0.52.1`
- `0.51.1`
- `0.50.1`
- `0.49.1`
- `0.48.1`
- `0.47.1`
- `0.46.1`
- `0.15.1`
- `0.14.1`
- `0.13.1`
- `0.12.1`
- `0.11.1`
- `0.10.2`
- `0.9.1`
- `0.8.1`
- `0.7.1`
- `0.6.1`
- `0.5.3`
- `0.3.1`
- `0.2.1`

### Workarounds
Disable TRACE-level logging for AWS Rust SDK crates.