Every CVE Search/ Get API key

CVE-2022-31008

Predictable credential obfuscation seed value used in rabbitmq-server

5.5 MediumFix available

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.40%Down 0.5 points since Oct 7, 2022
90%50%10%1%

What each source reports

CVE List Score used 5.5

Predictable credential obfuscation seed value used in rabbitmq-server

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
CVE-2022-31008
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-330
Updated
2026-11-02
EUVDEUVD-2022-52713 5.5

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

Record
EUVD-2022-52713
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v9gv-xp36-jgj8 5.5

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

Impact

Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret.

This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.

Patched versions correctly use a cluster-wide secret for that purpose.

Patches

Patched versions:

  • 3.10.2
  • 3.9.18
  • 3.8.32

Workarounds

Disable Shovel and Federation plugins.

Credits

RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions for responsibly disclosing and working with us on a patch for this vulnerability.

For more information

Record
GHSA-v9gv-xp36-jgj8
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-330, CWE-335
Updated
2026-11-02
NVD 5.5

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
CVE-2022-31008
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-330, CWE-335
Updated
2026-11-02
OSV 5.5

Predictable credential obfuscation seed value used in rabbitmq-server

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
CVE-2022-31008
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-330
Updated
2026-11-02
OSVGHSA-v9gv-xp36-jgj8 5.5

RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

Impact

Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret.

This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.

Patched versions correctly use a cluster-wide secret for that purpose.

Patches

Patched versions:

  • 3.10.2
  • 3.9.18
  • 3.8.32

Workarounds

Disable Shovel and Federation plugins.

Credits

RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions for responsibly disclosing and working with us on a patch for this vulnerability.

For more information

Record
GHSA-v9gv-xp36-jgj8
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-330, CWE-335
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2022-31008 5.5

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
UBUNTU-CVE-2022-31008
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBIT-rabbitmq-2022-31008 No score

Predictable credential obfuscation seed value used in rabbitmq-server

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
BIT-rabbitmq-2022-31008
Updated
2026-11-02
OSVDEBIAN-CVE-2022-31008 No score

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: 3.10.2, 3.9.18, 3.8.32 are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Record
DEBIAN-CVE-2022-31008
Updated
2026-11-03
OSVSUSE-FU-2024:2078-1 No score

Feature update for rabbitmq-server313, erlang26, elixir115

This update for rabbitmq-server313, erlang26, elixir115 fixes the following issues:

rabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 (jsc#PED-8414):

  • Security issues fixed:

    • CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice (DoS) attacks (bsc#1186203)
    • CVE-2021-32718, CVE-2021-32719: Fixed potential for JavaScript code execution in the management UI (bsc#1187818, bsc#1187819)
    • CVE-2022-31008: Fixed encryption key used to encrypt the URI was seeded with a predictable secret (bsc#1205267)
    • CVE-2023-46118: Fixed HTTP API vulnerability for denial of service (DoS) attacks with very large messages (bsc#1216582)

  • Other bugs fixed:

    • Fixed RabbitMQ maintenance status issue (bsc#1199431)
    • Provide user/group for RPM 4.19 (bsc#1219532)
    • Fixed rabbitmqctl command for add_user (bsc#1222591)
    • Added hardening to systemd service(s) (bsc#1181400)
    • Use /run instead of deprecated /var/run in tmpfiles.conf (bsc#1185075)

  • For the full list of upstream changes of this update between version 3.8.11 and 3.13.1 please consult:

erlang26:

  • Provide RPM package as it's a dependency of rabbitmq-server313 (jsc#PED-8414)

elixir115:

  • Provide RPM package as needed in some cases by rabbitmq-server313 (jsc#PED-8414)
Record
SUSE-FU-2024:2078-1
Updated
2026-11-02
OSVSUSE-SU-2022:4378-1 No score

Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues:

  • CVE-2022-31008: Fixed predictable secret seed in URI encryption (bsc#1205267).
Record
SUSE-SU-2022:4378-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rabbit_common
Hex
 3.10.0 up to 3.10.2
3.10.2
rabbit_common
Hex
 3.9.0 up to 3.9.18
3.9.18
rabbit_common
Hex
 3.8.0 up to 3.8.32
3.8.32
rabbitmq
Bitnami
 before 3.8.32
3.8.32
rabbitmq-server
Debian:12
 before 3.10.8-1
3.10.8-1
rabbitmq-server
Debian:13
 before 3.10.8-1
3.10.8-1
rabbitmq-server
Debian:14
 before 3.10.8-1
3.10.8-1
rabbit_common
Hex
 3.10.0 up to 3.10.2, plus listed versions
3.10.1
3.10.2
rabbit_common
Hex
 3.9.0 up to 3.9.18, plus listed versions
3.9.13.9.103.9.113.9.153.9.16
Show 9 moreShow less
3.9.173.9.23.9.33.9.43.9.53.9.63.9.73.9.83.9.9
3.9.18
rabbit_common
Hex
 3.8.0 up to 3.8.32, plus listed versions
3.8.13.8.1-rc.13.8.103.8.10-rc.13.8.10-rc.5
Show 33 moreShow less
3.8.10-rc.63.8.113.8.12-rc.13.8.12-rc.23.8.12-rc.33.8.143.8.193.8.23.8.2-rc.13.8.203.8.213.8.223.8.233.8.243.8.253.8.263.8.33.8.3-rc.13.8.3-rc.23.8.303.8.313.8.43.8.4-rc.13.8.4-rc.33.8.53.8.5-rc.13.8.5-rc.23.8.63.8.6-rc.13.8.6-rc.23.8.73.8.83.8.9
3.8.32
Show 11 moreShow less
Affected packages
PackageAffectedFixed
elixir115
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 5 CVEs
 before 1.15.7-150300.7.5.1
1.15.7-150300.7.5.1
erlang26
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 5 CVEs
 before 26.2.1-150300.7.5.1
26.2.1-150300.7.5.1
rabbitmq-server313
SUSE:Linux Enterprise Module for Server Applications 15 SP6
From an advisory covering 5 CVEs
 before 3.13.1-150600.13.5.3
3.13.1-150600.13.5.3
elixir115
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 1.15.7-150300.7.5.1
1.15.7-150300.7.5.1
erlang26
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 26.2.1-150300.7.5.1
26.2.1-150300.7.5.1
rabbitmq-server313
openSUSE:Leap 15.6
From an advisory covering 5 CVEs
 before 3.13.1-150600.13.5.3
3.13.1-150600.13.5.3
rabbitmq-server
SUSE:Linux Enterprise Module for Server Applications 15 SP3
 before 3.8.11-150300.3.11.1
3.8.11-150300.3.11.1
rabbitmq-server
SUSE:Linux Enterprise Module for Server Applications 15 SP4
 before 3.8.11-150300.3.11.1
3.8.11-150300.3.11.1
rabbitmq-server
openSUSE:Leap 15.3
 before 3.8.11-150300.3.11.1
3.8.11-150300.3.11.1
rabbitmq-server
openSUSE:Leap 15.4
 before 3.8.11-150300.3.11.1
3.8.11-150300.3.11.1
broker
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.4.0+ds1-11.4.0+ds1-1build1
 None known

History

History
RecordedChangedSources
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31008 is a medium vulnerability (CVSS 5.5) in Rabbitmq Rabbitmq-server, published October 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in rabbit_common 3.10.2.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open