{"action":"Upgrade object_store to 0.10.2 or later.","affected":[{"fixed":"0.10.2","introduced":"0.5.0"}],"component":"object_store","cve_ids":["CVE-2024-41178"],"ecosystem":"crates.io","epss":0.0071,"exploited":false,"fixed_versions":["0.10.2"],"ghsa_id":"GHSA-c2hf-vcmr-qjrf","id":"tcs_01M5KF99C3HCHZ9CV1EVH4J668","modified_at":"2025-10-28T06:02:18Z","published_at":"2024-07-23T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2024-0358","https://crates.io/crates/object_store","https://rustsec.org/advisories/RUSTSEC-2024-0358.html","https://github.com/apache/arrow-rs/pull/6074","https://www.openwall.com/lists/oss-security/2024/07/23/3"],"severity":{"label":"low","score":3.8},"sources":[{"source":"osv","source_id":"RUSTSEC-2024-0358","url":"https://osv.dev/vulnerability/RUSTSEC-2024-0358"}],"summary":"Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files"}