CVE-2023-30610: AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

April 26, 2023 (updated April 6, 2026)

The aws_sigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user’s AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to anyone with access to logs.

References

Code Behaviors & Features

Detect and mitigate CVE-2023-30610 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions starting from 0.2.0 before 0.2.1, version 0.2.0, all versions starting from 0.3.0 before 0.3.1, version 0.3.0, all versions starting from 0.4.1 before 0.4.2, version 0.4.1, all versions starting from 0.5.2 before 0.5.3, version 0.5.2, all versions starting from 0.6.0 before 0.6.1, version 0.6.0, all versions starting from 0.7.0 before 0.7.1, version 0.7.0, all versions starting from 0.8.0 before 0.8.1, version 0.8.0, all versions starting from 0.9.0 before 0.9.1, version 0.9.0, all versions starting from 0.10.1 before 0.10.2, version 0.10.1, all versions starting from 0.11.0 before 0.11.1, version 0.11.0, all versions starting from 0.12.0 before 0.12.1, version 0.12.0, all versions starting from 0.13.0 before 0.13.1, version 0.13.0, all versions starting from 0.14.0 before 0.14.1, version 0.14.0, all versions starting from 0.15.0 before 0.15.1, version 0.15.0, all versions starting from 0.46.0 before 0.46.1, version 0.46.0, all versions starting from 0.47.0 before 0.47.1, version 0.47.0, all versions starting from 0.48.0 before 0.48.1, version 0.48.0, all versions starting from 0.49.0 before 0.49.1, version 0.49.0, all versions starting from 0.51.0 before 0.51.1, version 0.51.0, all versions starting from 0.52.0 before 0.52.1, version 0.52.0, all versions starting from 0.53.1 before 0.53.2, version 0.53.1, all versions starting from 0.54.1 before 0.54.2, version 0.54.1, all versions starting from 0.55.0 before 0.55.1, version 0.55.0