MEDIUM
GHSA-fc4h-xcf3-qj5f
matrix-sdk 0.6.0 logs access tokens
Details
When sending Matrix requests using an affected version of `matrix-sdk` in an application that writes logs using `tracing-subscriber` (in a way that includes fields of tracing spans such as `tracing_subscriber`s default text output from the `fmt` module), these logs will contain the user's access token.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io/matrix-sdk
Introduced in:
0.6.0Fixed in: 0.6.2Upgrade matrix-sdk to 0.6.2 or newer (ecosystem crates.io).