CVE-2022-31008

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31008
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31008.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31008
Aliases
Downstream
Related
Published
2022-10-06T00:00:00Z
Modified
2026-04-10T04:47:53.904704Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Predictable credential obfuscation seed value used in rabbitmq-server
Details

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-330"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31008.json"
}
References

Affected packages

Git / github.com/rabbitmq/rabbitmq-server

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
32d866916accab5bc8638ea592ff9eb1dba04d69
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.8.32"
        }
    ]
}
Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-server
Events
Introduced
e09fb7d8a8e3700d023945a4a4345340e9fe32f1
Fixed
8cefec0f6e8afc597839f17e2681f3b726d64691
Database specific 
{
    "versions": [
        {
            "introduced": "3.9.0"
        },
        {
            "fixed": "3.9.18"
        }
    ]
}
Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-server
Events
Introduced
d17924a1b809f4b93e93ca47bee8875eb745201a
Fixed
c6c3789330ddcb40c463599bed8d6c053e4b254f
Database specific 
{
    "versions": [
        {
            "introduced": "3.10.0"
        },
        {
            "fixed": "3.10.2"
        }
    ]
}

Affected versions

base-for-tanzu-rabbitmq-2020.*
base-for-tanzu-rabbitmq-2020.12-additions
Other
rabbitmq_v1_4_0
rabbitmq_v1_5_0
rabbitmq_v1_6_0
rabbitmq_v1_7_0
rabbitmq_v1_7_2
rabbitmq_v1_8_1
rabbitmq_v2_4_0
rabbitmq_v2_7_1
rabbitmq_v2_8_0
rabbitmq_v3_0_0
rabbitmq_v3_0_1
rabbitmq_v3_0_2
rabbitmq_v3_0_3
rabbitmq_v3_0_4
rabbitmq_v3_1_1
rabbitmq_v3_1_2
rabbitmq_v3_1_3
rabbitmq_v3_1_4
rabbitmq_v3_1_5
rabbitmq_v3_2_1
rabbitmq_v3_2_2
rabbitmq_v3_2_3
rabbitmq_v3_2_4
rabbitmq_v3_3_0
rabbitmq_v3_3_1
rabbitmq_v3_3_2
rabbitmq_v3_3_3
rabbitmq_v3_3_4
rabbitmq_v3_3_5
rabbitmq_v3_4_0
rabbitmq_v3_4_1
rabbitmq_v3_4_2
rabbitmq_v3_4_3
rabbitmq_v3_5_0
rabbitmq_v3_6_0
rabbitmq_v3_6_0_milestone1
rabbitmq_v3_6_0_milestone2
rabbitmq_v3_6_0_milestone3
rabbitmq_v3_6_0_rc1
rabbitmq_v3_6_0_rc2
rabbitmq_v3_6_0_rc3
rabbitmq_v3_7_0_milestone1
rabbitmq_v3_7_0_milestone10
rabbitmq_v3_7_0_milestone11
rabbitmq_v3_7_0_milestone12
rabbitmq_v3_7_0_milestone13
rabbitmq_v3_7_0_milestone14
rabbitmq_v3_7_0_milestone15
rabbitmq_v3_7_0_milestone16
rabbitmq_v3_7_0_milestone17
rabbitmq_v3_7_0_milestone18
rabbitmq_v3_7_0_milestone2
rabbitmq_v3_7_0_milestone3
rabbitmq_v3_7_0_milestone4
rabbitmq_v3_7_0_milestone5
rabbitmq_v3_7_0_milestone7
rabbitmq_v3_7_0_milestone8
rabbitmq_v3_7_0_milestone9
v3.*
v3.10.0
v3.10.1
v3.7.0-beta.19
v3.7.0-beta.20
v3.7.0-rc.1
v3.7.0-rc.2
v3.8.0
v3.8.0-beta.1
v3.8.0-beta.2
v3.8.0-beta.3
v3.8.0-beta.4
v3.8.0-beta.5
v3.8.0-beta.6
v3.8.0-beta.7
v3.8.0-rc.1
v3.8.0-rc.2
v3.8.0-rc.3
v3.8.1
v3.8.1-beta.1
v3.8.1-beta.2
v3.8.1-rc.1
v3.8.10-beta.1
v3.8.10-rc.1
v3.8.10-rc.5
v3.8.10-rc.6
v3.8.11
v3.8.12
v3.8.12-beta.1
v3.8.12-rc.1
v3.8.12-rc.2
v3.8.12-rc.3
v3.8.13
v3.8.13-beta.1
v3.8.14
v3.8.15
v3.8.15-rc.2
v3.8.15-rc.3
v3.8.16
v3.8.17
v3.8.17-rc.1
v3.8.17-rc.2
v3.8.18
v3.8.18-beta.1
v3.8.18-rc.1
v3.8.19
v3.8.19-rc.1
v3.8.2
v3.8.2-rc.1
v3.8.20
v3.8.21
v3.8.22
v3.8.23
v3.8.24
v3.8.25
v3.8.26
v3.8.27
v3.8.28
v3.8.29
v3.8.3
v3.8.3-beta.1
v3.8.3-beta.2
v3.8.3-beta.3
v3.8.3-rc.1
v3.8.3-rc.2
v3.8.30
v3.8.31
v3.8.4
v3.8.4-beta.1
v3.8.4-rc.1
v3.8.4-rc.2
v3.8.4-rc.3
v3.8.5
v3.8.5-rc.1
v3.8.5-rc.2
v3.8.6
v3.8.6-beta.1
v3.8.6-rc.1
v3.8.6-rc.2
v3.8.7
v3.8.8
v3.8.9
v3.9.0
v3.9.1
v3.9.10
v3.9.11
v3.9.12
v3.9.13
v3.9.14
v3.9.15
v3.9.16
v3.9.17
v3.9.2
v3.9.3
v3.9.4
v3.9.5
v3.9.6
v3.9.7
v3.9.8
v3.9.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31008.json"