CVE-2022-31008 — Vulnetix

CVE-2022-31008 PUBLISHED

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

EPSS 0.19% · 40.9th percentile

Risk Scores

EPSS Score

0.19%

40.9th percentile

Affected Products

Vendor	Product	Versions
Bitnami	rabbitmq	0
Bitnami	rabbitmq	0

Timeline

Oct 5, 2022 CVE Published
Oct 7, 2022 EPSS Score
Nov 20, 2022 EPSS Score
Jan 2, 2023 EPSS Score
Feb 15, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 30, 2023 EPSS Score
May 13, 2023 EPSS Score
Jun 26, 2023 EPSS Score
Aug 8, 2023 EPSS Score
Sep 21, 2023 EPSS Score
Nov 3, 2023 EPSS Score

References

Open in Interactive Console →