Vulnerability MediumRUSTSEC-2023-0125 · aws-sigv4
RUSTSEC-2023-0125: Logs AWS credentials when TRACE-level logging is enabled
Short answerA security vulnerability in the aws-sigv4 crate: Logs AWS credentials when TRACE-level logging is enabled. Medium severity (CVSS 5.5). Fixed in 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.2.1, 0.3.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.5.3, 0.50.1, 0.51.1, 0.52.1, 0.53.2, 0.54.2, 0.55.1, 0.6.1, 0.7.1, 0.8.1, 0.9.1: update to a fixed version.
| Crate | aws-sigv4 |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.2.1; from 0.3.0 before 0.3.1; from 0.4.0 before 0.5.3; from 0.6.0 before 0.6.1; from 0.7.0 before 0.7.1; from 0.8.0 before 0.8.1; from 0.9.0 before 0.9.1; from 0.10.0 before 0.10.2; from 0.11.0 before 0.11.1; from 0.12.0 before 0.12.1; from 0.13.0 before 0.13.1; from 0.14.0 before 0.14.1; from 0.15.0 before 0.15.1; from 0.16.0 before 0.46.1; from 0.47.0 before 0.47.1; from 0.48.0 before 0.48.1; from 0.49.0 before 0.49.1; from 0.50.0 before 0.50.1; from 0.51.0 before 0.51.1; from 0.52.0 before 0.52.1; from 0.53.0 before 0.53.2; from 0.54.0 before 0.54.2; from 0.55.0 before 0.55.1. |
| Fixed in | 0.10.2, 0.11.1, 0.12.1, 0.13.1, 0.14.1, 0.15.1, 0.2.1, 0.3.1, 0.46.1, 0.47.1, 0.48.1, 0.49.1, 0.5.3, 0.50.1, 0.51.1, 0.52.1, 0.53.2, 0.54.2, 0.55.1, 0.6.1, 0.7.1, 0.8.1, 0.9.1 |
| Severity | Medium, CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published | 2023-04-19 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2023-30610, GHSA-mjv9-vp6w-3rc9 |
What to do
- See which version you have:
cargo tree -i aws-sigv4(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p aws-sigv4. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for exampleaws-sigv4 = "0.9.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
aws-sigv4 is a rust library for low level request signing in the aws cloud platform.
The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.
All users of the AWS SDK for Rust who enabled TRACE-level logging, either globally (e.g. RUST_LOG=trace), or for the aws-sigv4 crate specifically are affected.
This issue has been addressed in a set of new releases.
Users are advised to upgrade.
Users unable to upgrade should disable TRACE-level logging for AWS Rust SDK crates.
References
- Package: crates.io/crates/aws-sigv4
- Advisory: rustsec.org/advisories/RUSTSEC-2023-0125.html
- Web: github.com/smithy-lang/smithy-rs/pull/2562
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Same crateaws-sigv4: security historyEvery advisory for this crate, and whether it is safe to use today.Read it next →Did this answer your question?