CVE-2022-31008: Predictable credential obfuscation seed value used in rabbitmq-server
First published: Thu Oct 06 2022(Updated: )
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Vmware Rabbitmq | <3.8.32 | |
| Vmware Rabbitmq | >=3.9.0<3.9.18 | |
| Vmware Rabbitmq | >=3.10.0<3.10.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-31008?
CVE-2022-31008 is a vulnerability in RabbitMQ where the shovel and federation plugins perform URI obfuscation in their worker state, using a predictable encryption key.
How can CVE-2022-31008 impact me?
CVE-2022-31008 can potentially allow an attacker to decrypt the obfuscated URI and gain unauthorized access to sensitive information or perform other malicious activities.
What versions of RabbitMQ are affected by CVE-2022-31008?
CVE-2022-31008 affects RabbitMQ versions up to and including 3.8.32, 3.9.0 to 3.9.18, and 3.10.0 to 3.10.2.
How do I fix CVE-2022-31008?
To fix CVE-2022-31008, upgrade your RabbitMQ installation to a version that is not affected by the vulnerability.
Are there any references for CVE-2022-31008?
Yes, you can find more information about CVE-2022-31008 in the following references: [Link 1](https://github.com/rabbitmq/rabbitmq-server/pull/4841) and [Link 2](https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8).
- collector/nvd-index
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/vmware
- canonical/vmware rabbitmq
- version/vmware rabbitmq/3.9.0
- version/vmware rabbitmq/3.10.0