GitHub Advisoryadvisory · crates.io

GHSA-fc4h-xcf3-qj5f matrix-sdk 0.6.0 logs access tokens

MEDIUM Published 2022-10-25 Modified 2022-10-25 Official page ↗
Ecosystem
crates.io
Packages
matrix-sdk
Severity
Moderate
Reviewed
2022-10-25

Affected packages

• crates.io matrix-sdk: >= 0.6.0, < 0.6.2 → fixed in 0.6.2

Description

When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.

References