CVE-2022-31008 Predictable credential obfuscation seed value used in rabbitmq-server
Attackers can decrypt sensitive URIs in logs due to predictable encryption seeds in RabbitMQ Shovel and Federation plugins.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-31008?
CVE-2022-31008 is a medium-severity vulnerability in Broadcom Rabbitmq Server, published on 6 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
Which versions are affected by CVE-2022-31008?
7 open source packages ship an affected version, including rabbitmq and rabbit_common. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | All versions | 3.8.32 |
rabbit_common Hex | From 3.10.0 | 3.10.2 |
rabbit_common Hex | From 3.10.0 | 3.10.2 |
rabbit_common Hex | From 3.8.0 | 3.8.32 |
rabbit_common Hex | From 3.8.0 | 3.8.32 |
rabbit_common Hex | From 3.9.0 | 3.9.18 |
1 more packages
rabbit_common Hex | From 3.9.0 | 3.9.18 |
Linux distribution packages (4)
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 3.8.11-150300.3.11.1 |
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 3.8.11-150300.3.11.1 |
rabbitmq-server openSUSE:Leap 15.3 | All versions | 3.8.11-150300.3.11.1 |
rabbitmq-server openSUSE:Leap 15.4 | All versions | 3.8.11-150300.3.11.1 |
Products include Broadcom Rabbitmq Server, Vmware Rabbitmq.
How do I fix CVE-2022-31008?
Upgrade rabbitmq to 3.8.32 or later.
Is CVE-2022-31008 being exploited?
There is no known exploitation of CVE-2022-31008 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as BIT-rabbitmq-2022-31008, DEBIAN-CVE-2022-31008, GHSA-v9gv-xp36-jgj8, SUSE-SU-2022:4378-1, UBUNTU-CVE-2022-31008.