Riskcovery

CVE-2022-31008

Predictable credential obfuscation seed value used in rabbitmq-server

State
Published
Severity
5.5 Medium
Published
Oct 6, 2022
Updated
Apr 23, 2025
Reserved
May 18, 2022

Read the record on cve.org

Description

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-330 Use of Insufficiently Random Values

Affected Products

ProductVersions
rabbitmq-serverrabbitmq
  • < 3.8.32Affected
  • >= 3.9.0, < 3.9.18Affected
  • >= 3.10.0, < 3.10.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.