Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2022-31008 Details

Description

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/rabbitmq/rabbitmq-server/pull/4841 CVEPatchThird Party Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8 CVEThird Party Advisory
https://github.com/rabbitmq/rabbitmq-server/pull/4841 [email protected]PatchThird Party Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8 [email protected]Third Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)[email protected]
CWE-330Use of Insufficiently Random Values[email protected]

Affected Products

ProductVersions
broadcom rabbitmq server
>= 3.9.0, < 3.9.18
>= 3.10.0, < 3.10.2

CPE

  • cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
vmware rabbitmq
< 3.8.32

CPE

  • cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

12 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2022-31008
NVD Published Date:
Oct 6, 2022
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]