GHSA-v9gv-xp36-jgj8 BIT-rabbitmq-2022-31008 CVE-2022-31008
RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins
- Severity
- 5.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.40%
- Chance of exploitation in the next 30 days. Higher than 33.99% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-330 Use of Insufficiently Random Values
- CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
- Fix
3.10.2- Upgrade rabbit_common to this version or later
Description
Impact
Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret.
This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.
Patched versions correctly use a cluster-wide secret for that purpose.
Patches
Patched versions:
3.10.23.9.183.8.32
Workarounds
Disable Shovel and Federation plugins.
Credits
RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions for responsibly disclosing and working with us on a patch for this vulnerability.
For more information
Affected versions
Hex
| Package | Vulnerable | Fixed in |
|---|---|---|
| rabbit_common | >= 3.10.0, < 3.10.2 |
3.10.2 |
| rabbit_common | >= 3.9.0, < 3.9.18 |
3.9.18 |
| rabbit_common | >= 3.8.0, < 3.8.32 |
3.8.32 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rabbit_common Hex → 3.10.2
- mix
{:rabbit_common, "~> 3.10.2"} # then: mix deps.update rabbit_common
Severity breakdown
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-330: Use of Insufficiently Random Values
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
How to prevent it
- Architecture and Design: Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
- Implementation: Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
- Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-pj33-75x5-32j4 RabbitMQ HTTP API's queue deletion endpoint does not verify that the user has a required permission | Medium | Also affects rabbit_common |
| GHSA-w6cq-9cf4-gqpg RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API | Medium | Also affects rabbit_common |
| GHSA-9pf7-f47q-mwpq Cross-site Scripting in RabbitMQ | Low | Also affects rabbit_common |
| EEF-CVE-2026-81852 AshAdmin ships a hardcoded CSP nonce, allowing nonce-based CSP bypass | Not rated yet | Same weakness, CWE-330 |
| GHSA-qv2q-c278-pch5 ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse | Medium | Same weakness, CWE-330 |
| GHSA-2rhw-gw3f-477j DNN: Same HostGUID for all new installs | Medium | Same weakness, CWE-330 |
| GHSA-9jpj-g8vv-j5mf OpenClaw: Gemini OAuth exposed the PKCE verifier through the OAuth state parameter | Medium | Same weakness, CWE-330 |
| GHSA-vfgx-5q85-58q3 openssl-encrypt has non-cryptographic PRNG used for steganography pixel selection | High | Same weakness, CWE-330 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor