RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

The version of RabbitMQ installed on the remote host is 3.8.x prior to 3.8.32, 3.9.x prior to 3.9.18, or 3.10.x prior to 3.10.2. It is, therefore, affected by a vulnerability:

  - RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins     perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a     predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins,     reasonably easily deobfuscatable data could appear in the node log. (CVE-2022-31008)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and     federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to     encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions     related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node     log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed     and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable     the Shovel and Federation plugins. (CVE-2022-31008)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-FU-2024:2078-1 advisory.

    rabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 (jsc#PED-8414):

    - Security issues fixed:

      * CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice (DoS) attacks     (bsc#1186203)
      * CVE-2021-32718, CVE-2021-32719: Fixed potential for JavaScript code execution in the management UI         (bsc#1187818, bsc#1187819)
      * CVE-2022-31008: Fixed encryption key used to encrypt the URI was seeded with a predictable secret     (bsc#1205267)
      * CVE-2023-46118: Fixed HTTP API vulnerability for denial of service (DoS) attacks with very large     messages         (bsc#1216582)

    - Other bugs fixed:

      * Fixed RabbitMQ maintenance status issue (bsc#1199431)
      * Provide user/group for RPM 4.19 (bsc#1219532)
      * Fixed `rabbitmqctl` command for `add_user` (bsc#1222591)
      * Added hardening to systemd service(s) (bsc#1181400)
      * Use /run instead of deprecated /var/run in tmpfiles.conf (bsc#1185075)

    - For the full list of upstream changes of this update between version 3.8.11 and 3.13.1 please consult:

      * https://www.rabbitmq.com/release-information

    erlang26:

    - Provide RPM package as it's a dependency of rabbitmq-server313 (jsc#PED-8414)

    elixir115:

    - Provide RPM package as needed in some cases by rabbitmq-server313 (jsc#PED-8414)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4378-1 advisory.

  - RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and     federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to     encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions     related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node     log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed     and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable     the Shovel and Federation plugins. (CVE-2022-31008)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
234567	RabbitMQ 3.8.x < 3.8.32 / 3.9.x < 3.9.18 / 3.10.x < 3.10.2 Predictable credential obfuscation	Nessus	Misc.	high
224613	Linux Distros Unpatched Vulnerability : CVE-2022-31008	Nessus	Misc.	high
200752	SUSE SLES15 / openSUSE 15 : Feature update for rabbitmq-server313, erlang26, elixir115 (SUSE-SU-SUSE-FU-2024:2078-1)	Nessus	SuSE Local Security Checks	high
168537	SUSE SLES15 Security Update : rabbitmq-server (SUSE-SU-2022:4378-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-31008

high

Tenable Plugins

high

high

high

high