CVE-2024-41178: 
Rust vulnerability analysis and mitigation

Apache Arrow Rust Object Store (object_store crate) version 0.10.1 and earlier contains a vulnerability related to the exposure of temporary credentials in logs when using AWS WebIdentityTokens. The vulnerability was discovered by Paul Hatcherian and assigned CVE-2024-41178. The issue affects all platforms using AWS WebIdentityTokens with versions from 0.5.0 through 0.10.1 (Apache Security).

The vulnerability occurs when using AWS WebIdentityTokens with the object_store crate. During failure events and automatic retry attempts, the system logs the underlying reqwest error, which includes the full URL containing credentials in the parameters. This exposes the OIDC token that is passed to AssumeRoleWithWebIdentity. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (CISA-ADP).

An attacker with access to the logs can impersonate the identity associated with the exposed OIDC token and perform their own calls to AssumeRoleWithWebIdentity. The impact is limited by the token's expiration period, which typically lasts up to an hour, though this duration may vary depending on the issuer (Apache Security).

Users are recommended to either upgrade to version 0.10.2 which contains the fix, use a different AWS authentication mechanism, or disable logging. The vulnerability has been patched in version 0.10.2 (Apache Security).