Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

object_store

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.8crates.ioPublished

    Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

    CVE-2024-41178 · GHSA-c2hf-vcmr-qjrf

    Affected
    • crates.io object_store >= 0.5.0, < 0.10.2
    Fixed in
    0.10.2· Vendor fix available
    Issue
    Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (objectstore crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity https://docs.aws.amazon.com/STS/latest/APIReference/APIAssumeRoleWithWebIdentity.html . This allows someone with access to the logs to impersonate that identity, including performing their own calls to AssumeRoleWithWebIdentity, until the OIDC token expires. Typically OIDC tokens are valid for up to an hour, although this will vary depending on the issuer. Users are recommended to use a different AWS authentication mechanism, disable logging or upgrade to version 0.10.2, which fixes this issue. Details: When using AWS WebIdentityTokens with the objectstore crate, in the event of a failure and automatic retry, the underlying reqwest error, including the full URL with the credentials, potentially in the parameters, is…

    Recommended action: Upgrade to 0.10.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →