crates.io object_store vulnerabilities

Latest crates.io object_store CVEs

Newest publication first

1. CVE-2024-41178 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

   Published 2024-07-23

   High·CVSS 7.5 EPSS 0.71%

   Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (object_store crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity https://...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.