CVE-2023-30610

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-306115.3Discourse-reactions is a plugin that allows user to add their reactions to the post in the Discourse messaging platform. In affected versionCVE-2023-306124.9Cloud hypervisor is a Virtual Machine Monitor for Cloud workloads. This vulnerability allows users to close arbitrary open file descriptors CVE-2023-306139.0Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMCVE-2023-306146.1Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflecteCVE-2023-306155.4Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-SiteCVE-2023-306166.5Form block is a wordpress plugin designed to make form creation easier. Versions prior to 1.0.2 are subject to a Cross-Site Request Forgery CVE-2023-306176.5Kruise provides automated management of large-scale applications on Kubernetes. Starting in version 0.8.0 and prior to versions 1.3.1, 1.4.1CVE-2023-306183.3Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and veriCVE-2023-306195.4Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifactCVE-2023-30629.8A vulnerability was found in code-projects Agro-School Management System 1.0. It has been classified as critical. Affected is an unknown funCVE-2023-306207.5mindsdb is a Machine Learning platform to help developers build AI solutions. In affected versions an unsafe extraction is being performed uCVE-2023-306219.8Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run comman
CVE-2023-30610: Medium severity, CVSS 5.5 | Vulnix