RUSTSEC-2022-0062

    Dashboard / Vulnerabilities / RUSTSEC-2022-0062

    RUSTSEC-2022-0062

    Published: 24 Oct 2022Last Modified: 8 Nov 2023

    Summary: matrix-sdk 0.6.0 logs access tokens

    Details: When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.

    References: https://crates.io/crates/matrix-sdk, https://rustsec.org/advisories/RUSTSEC-2022-0062.html, https://github.com/matrix-org/matrix-rust-sdk/issues/1110

    Affected packages

    Package

    Name: matrix-sdk

    Purl: pkg:cargo/matrix-sdk

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.6.0
    Fixed -0.6.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RUSTSEC-2022-0062 | CVE-DB