CVE-2022-31008 : RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perf

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Published 2022-10-06 18:16:01

Updated 2023-07-21 17:09:19

Source GitHub, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-31008

EPSS FAQ

0.11%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-31008

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	GitHub, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2022-31008

CWE-330 Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Assigned by: security-advisories@github.com (Secondary)

CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-31008

https://github.com/rabbitmq/rabbitmq-server/pull/4841

Implement fallback secret for credentials obfuscation (by @luos) by michaelklishin · Pull Request #4841 · rabbitmq/rabbitmq-server · GitHub
Patch;Third Party Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8

Predictable credential obfuscation seed value used in Shovel and Federation plugins · Advisory · rabbitmq/rabbitmq-server · GitHub
Third Party Advisory

Products affected by CVE-2022-31008

Vmware » Rabbitmq
Versions from including (>=) 3.10.0 and before (<) 3.10.2
cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*
Matching versions
Vmware » Rabbitmq
Versions from including (>=) 3.9.0 and before (<) 3.9.18
cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*
Matching versions
Vmware » Rabbitmq
Versions before (<) 3.8.32
cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2022-31008

Exploit prediction scoring system (EPSS) score for CVE-2022-31008

CVSS scores for CVE-2022-31008

CWE ids for CVE-2022-31008

References for CVE-2022-31008

Products affected by CVE-2022-31008