Reported

October 24, 2022

Issued

October 24, 2022 (last modified: June 13, 2023)

Package

matrix-sdk (crates.io)

Type

Vulnerability

Aliases

• GHSA-fc4h-xcf3-qj5f

References

• https://github.com/matrix-org/matrix-rust-sdk/issues/1110

Patched

• >=0.6.2

Unaffected

• <0.6.0

Description

When sending Matrix requests using an affected version of matrix-sdk in an application that writes logs using tracing-subscriber (in a way that includes fields of tracing spans such as tracing_subscribers default text output from the fmt module), these logs will contain the user's access token.

Advisory available under CC0-1.0 license.