5.5

CVE-2023-30610: amazon aws-sigv4

CVSS: 5.5v3.1MediumModified
AliasesGHSA-mjv9-vp6w-3rc9RUSTSEC-2023-0125
Published 19-04-2023Last modified 05-02-2025
Open JSON

Vulnerability summary

CVE-2023-30610 is a medium (CVSS 5.5) vulnerability in amazon aws-sigv4. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 19-04-2023
    PublishedVulnerability first disclosed.
  2. 05-02-2025
    Last modifiedVulnerability information updated.

Description

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, `SigningParams` is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. `RUST_LOG=trace`), or for the `aws-sigv4` crate specifically are affected. This issue has been addressed in a set of new releases. Users are advised to upgrade. Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.21%

Chance of exploitation in the next 30 days

Percentile

11%

Versus all other CVEs

30-day change

0.00 pp

From 0.21% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.21%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Amazon1 product
  • aws-sigv40.2.0 | 0.3.0 | 0.4.1 | 0.5.2 | 0.6.0 | 0.7.0 | 0.8.0 | 0.9.0 | 0.10.1 | 0.11.0 | 0.12.0 | 0.13.0 | 0.14.0 | 0.15.0 | 0.46.0 | 0.47.0 | 0.48.0 | 0.49.0 | 0.50.0 | 0.51.0 | 0.52.0 | 0.53.1 | 0.54.1 | 0.55.0
Awslabs1 product
  • aws-sdk-rust≥ 0.2.0, < 0.2.1 | ≥ 0.3.0, < 0.3.1 | ≥ 0.4.1, < 0.4.2 | ≥ 0.5.2, < 0.5.3 | ≥ 0.6.0, < 0.6.1 | ≥ 0.7.0, < 0.7.1 | ≥ 0.8.0, < 0.8.1 | ≥ 0.9.0, < 0.9.1 | ≥ 0.10.1, < 0.10.2 | ≥ 0.11.0, < 0.11.1 | ≥ 0.12.0, < 0.12.1 | ≥ 0.13.0, < 0.13.1 | ≥ 0.14.0, < 0.14.1 | ≥ 0.15.0, < 0.15.1 | ≥ 0.46.0, < 0.46.1 | ≥ 0.47.0, < 0.47.1 | ≥ 0.48.0, < 0.48.1 | ≥ 0.49.0, < 0.49.1 | ≥ 0.50.0, < 0.51.1 | ≥ 0.52.0, < 0.52.1, | ≥ 0.53.1, < 0.53.2 | ≥ 0.54.1, < 0.54.2 | ≥ 0.55.0, < 0.55.1
Crates.Io1 product
  • aws-sigv4≥ 0.55.0, < 0.55.1 | ≥ 0.54.1, < 0.54.2 | ≥ 0.53.1, < 0.53.2 | ≥ 0.52.0, < 0.52.1 | ≥ 0.51.0, < 0.51.1 | ≥ 0.49.0, < 0.49.1 | ≥ 0.48.0, < 0.48.1 | ≥ 0.47.0, < 0.47.1 | ≥ 0.46.0, < 0.46.1 | ≥ 0.15.0, < 0.15.1 | ≥ 0.14.0, < 0.14.1 | ≥ 0.13.0, < 0.13.1 | ≥ 0.12.0, < 0.12.1 | ≥ 0.11.0, < 0.11.1 | ≥ 0.10.1, < 0.10.2 | ≥ 0.9.0, < 0.9.1 | ≥ 0.8.0, < 0.8.1 | ≥ 0.7.0, < 0.7.1 | ≥ 0.6.0, < 0.6.1 | ≥ 0.5.2, < 0.5.3 | ≥ 0.4.1, < 0.4.2 | ≥ 0.3.0, < 0.3.1 | ≥ 0.2.0, < 0.2.1 | ≥ 0.55.0-0, < 0.55.1

3 vendors · 3 products

References

6 links