UpHeron
All vulnerabilities

Servers and applications

CVE-2022-31008

Predictable credential obfuscation seed value used in Shovel and Federation plugins

Severity
High 7.5
Published
5 Oct 2022
Last changed
30 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.8.32, 3.9.18, 3.10.2
Also known as
GHSA-v9gv-xp36-jgj8
Sources
NVD, Project advisories (GitHub)

Description

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the…

Affected software

SoftwareAffected versions
RabbitMQServers and applications · cpe:a:broadcom:rabbitmq_server
  • From 3.9.0 before 3.9.18
  • From 3.10.0 before 3.10.2
RabbitMQServers and applications · cpe:a:vmware:rabbitmq
  • Every version before 3.8.32
RabbitMQServers and applications · github:rabbitmq/rabbitmq-server
  • From 3.8.0 before 3.8.32
  • From 3.9.0 before 3.9.18
  • From 3.10.0 before 3.10.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-31008
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-31008
  • GitHub Advisory Database https://github.com/advisories/GHSA-v9gv-xp36-jgj8
  • github.com https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8