{"action":"Upgrade object_store to 0.10.2 or later.","affected":[{"fixed":"0.10.2","introduced":"0.5.0"}],"component":"object_store","cve_ids":["CVE-2024-41178"],"ecosystem":"crates.io","epss":0.0071,"exploited":false,"fixed_versions":["0.10.2"],"ghsa_id":"GHSA-c2hf-vcmr-qjrf","id":"tcs_01M5KEWMX9YH8MGRD4XS5NQRMX","modified_at":"2026-09-10T03:50:16.603530985Z","published_at":"2024-07-23T18:31:07Z","references":["https://osv.dev/vulnerability/GHSA-c2hf-vcmr-qjrf","https://nvd.nist.gov/vuln/detail/CVE-2024-41178","https://github.com/apache/arrow-rs/pull/6074","https://github.com/apache/arrow-rs/commit/4978e32654235f569062f2cad6c7361e410f1254","https://github.com/apache/arrow-rs","https://lists.apache.org/thread/3t0povdppnt2czv6crlsqhvyko93kcrg","https://rustsec.org/advisories/RUSTSEC-2024-0358.html","http://www.openwall.com/lists/oss-security/2024/07/23/3"],"severity":{"label":"low","score":3.8},"sources":[{"source":"osv","source_id":"GHSA-c2hf-vcmr-qjrf","url":"https://osv.dev/vulnerability/GHSA-c2hf-vcmr-qjrf"}],"summary":"Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files"}