Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

azure_core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5crates.ioPublished

    Legacy azure_core writes the authorization header value to logs

    Affected
    • crates.io azure_core >= 0.0.0-0, < 0.2.0; >= 0.2.1-0, < 0.22.0
    Fixed in
    0.2.00.22.0· Vendor fix available
    Issue
    Applications built on the legacy Azure SDK for Rust (`azure_core` 0.21.0 and earlier) write the value of the outgoing `authorization` header to their logs whenever debug-level logging is enabled, and in every affected version also at trace level. The leaked values are live credentials — Microsoft Entra ID bearer tokens, Azure Storage SharedKey signatures, and SAS tokens — and anyone with read access to the logs can replay them until they expire (CWE-532). Versions 0.22.0 and later, which are the rewritten and currently supported SDK, do not contain the affected code. Affected versions Every published legacy version except 0.2.0 writes the `authorization` header value to logs: 0.1.1 (2022-01-25), and 0.2.1 through 0.21.0 (2024-10-15). Mitigation - Upgrade to `azure_core` 1.0.0 or newer. - If you are unable to upgrade, raise the log level above debug for the impacted crates or submit a feature request for missing crates built on `azure_core` 1.0.0 or newer. - Treat logs produced…

    Recommended action: Upgrade to 0.22.0 or 0.2.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →