Use of insufficiently random values in RabbitMQ Server - CVE-2022-31008

Vulnerability identifier: #VU69263

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31008

CWE-ID: CWE-330

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exist due to insufficient randomization in Shovel and Federation plugins when obfuscating URI. The encryption key used to encrypt the URI was seeded with a predictable secret. A remote attacker can gain access to sensitive information.

RabbitMQ Server
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server
SUSE Linux Enterprise Server for SAP Applications
Server Applications Module
openSUSE Leap
Oracle Solaris
elixir115-doc
elixir115
rabbitmq-server
rabbitmq-server-plugins
erlang-rabbitmq-client
rabbitmq-server313-zsh-completion
rabbitmq-server313-bash-completion
rabbitmq-server313
erlang-rabbitmq-client313
rabbitmq-server313-plugins
erlang26-observer-src
erlang26-debugger
erlang26-dialyzer-debuginfo
erlang26-diameter
erlang26-epmd
erlang26-wx-debuginfo
erlang26-dialyzer
erlang26
erlang26-wx
erlang26-doc
erlang26-dialyzer-src
erlang26-wx-src
erlang26-jinterface-src
erlang26-debugsource
erlang26-debugger-src
erlang26-src
erlang26-diameter-src
erlang26-observer
erlang26-epmd-debuginfo
erlang26-jinterface
erlang26-et
erlang26-reltool
erlang26-debuginfo
erlang26-et-src
erlang26-reltool-src

Install updates from vendor's website.

RabbitMQ Server - addressed in versions 3.8.32, 3.9.18, 3.10.2
elixir115-doc - update to 1.15.7-150300.7.5.1
elixir115 - update to 1.15.7-150300.7.5.1
rabbitmq-server - update to 3.8.11-150300.3.11.1
rabbitmq-server-plugins - update to 3.8.11-150300.3.11.1
erlang-rabbitmq-client - update to 3.8.11-150300.3.11.1
rabbitmq-server313-zsh-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313-bash-completion - update to 3.13.1-150600.13.5.3
rabbitmq-server313 - update to 3.13.1-150600.13.5.3
erlang-rabbitmq-client313 - update to 3.13.1-150600.13.5.3
rabbitmq-server313-plugins - update to 3.13.1-150600.13.5.3
Oracle Solaris - update to 11.4 SRU 62
erlang26-observer-src - update to 26.2.1-150300.7.5.1
erlang26-debugger - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-diameter - update to 26.2.1-150300.7.5.1
erlang26-epmd - update to 26.2.1-150300.7.5.1
erlang26-wx-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-dialyzer - update to 26.2.1-150300.7.5.1
erlang26 - update to 26.2.1-150300.7.5.1
erlang26-wx - update to 26.2.1-150300.7.5.1
erlang26-doc - update to 26.2.1-150300.7.5.1
erlang26-dialyzer-src - update to 26.2.1-150300.7.5.1
erlang26-wx-src - update to 26.2.1-150300.7.5.1
erlang26-jinterface-src - update to 26.2.1-150300.7.5.1
erlang26-debugsource - update to 26.2.1-150300.7.5.1
erlang26-debugger-src - update to 26.2.1-150300.7.5.1
erlang26-src - update to 26.2.1-150300.7.5.1
erlang26-diameter-src - update to 26.2.1-150300.7.5.1
erlang26-observer - update to 26.2.1-150300.7.5.1
erlang26-epmd-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-jinterface - update to 26.2.1-150300.7.5.1
erlang26-et - update to 26.2.1-150300.7.5.1
erlang26-reltool - update to 26.2.1-150300.7.5.1
erlang26-debuginfo - update to 26.2.1-150300.7.5.1
erlang26-et-src - update to 26.2.1-150300.7.5.1
erlang26-reltool-src - update to 26.2.1-150300.7.5.1

• https://github.com/rabbitmq/rabbitmq-server/pull/4841
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8

• Information disclosure in RabbitMQ Server
• SUSE update for rabbitmq-server
• Oracle Solaris update for thrid-party components
• SUSE update for Feature update for rabbitmq-server313, erlang26, elixir115