PT-2023-3900 · Amazon · Aws-Sigv4
Publicado
2023-04-18
·
Atualizado
2025-02-05
·
CVE-2023-30610
CVSS v3.1
5.5
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
aws-sigv4 versions prior to 0.55.1
aws-sigv4 version 0.54.2
aws-sigv4 version 0.53.2
aws-sigv4 version 0.52.1
aws-sigv4 version 0.51.1
aws-sigv4 version 0.50.1
aws-sigv4 version 0.49.1
aws-sigv4 version 0.48.1
aws-sigv4 version 0.47.1
aws-sigv4 version 0.46.1
aws-sigv4 version 0.15.1
aws-sigv4 version 0.14.1
aws-sigv4 version 0.13.1
aws-sigv4 version 0.12.1
aws-sigv4 version 0.11.1
aws-sigv4 version 0.10.2
aws-sigv4 version 0.9.1
aws-sigv4 version 0.8.1
aws-sigv4 version 0.7.1
aws-sigv4 version 0.6.1
aws-sigv4 version 0.5.3
aws-sigv4 version 0.3.1
aws-sigv4 version 0.2.1
Description
The issue is related to the
aws sigv4::SigningParams struct, which had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs. All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally or for the aws-sigv4 crate specifically, are affected.Recommendations
Upgrade to a version of aws-sigv4 that is 0.55.1 or later.
For versions prior to 0.55.1, disable TRACE-level logging for AWS Rust SDK crates.
For version 0.54.2, upgrade to a newer version or disable TRACE-level logging.
For version 0.53.2, upgrade to a newer version or disable TRACE-level logging.
For version 0.52.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.51.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.50.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.49.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.48.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.47.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.46.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.15.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.14.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.13.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.12.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.11.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.10.2, upgrade to a newer version or disable TRACE-level logging.
For version 0.9.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.8.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.7.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.6.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.5.3, upgrade to a newer version or disable TRACE-level logging.
For version 0.3.1, upgrade to a newer version or disable TRACE-level logging.
For version 0.2.1, upgrade to a newer version or disable TRACE-level logging.
Exploit
Correção
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Aws-Sigv4