Insufficiently protected credentials in RabbitMQ C client - CVE-2023-35789

Vulnerability identifier: #VU83439

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-35789

CWE-ID: CWE-522

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to the C AMQP client library for RabbitMQ requires credentials to be entered on the command line as arguments for amqp-publish and amqp-consume. A local user can view the list of processes on the system and obtain credentials to RabbitMQ deployment.

RabbitMQ C client
Oracle Linux
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for IBM z Systems
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Server 15 SP3 LTSS
Server Applications Module
openSUSE Leap
openEuler
librabbitmq (Red Hat package)
librabbitmq-debugsource
librabbitmq-debuginfo
librabbitmq-devel
librabbitmq-help
librabbitmq
rabbitmq-c-debuginfo
librabbitmq4
rabbitmq-c-tools-debuginfo
rabbitmq-c-tools
librabbitmq4-debuginfo
rabbitmq-c-debugsource
librabbitmq-doc
Storage Ceph

Install updates from vendor's website.

librabbitmq (Red Hat package) - addressed in versions 0.9.0-4.el8, 0.11.0-7.el9
librabbitmq-debugsource - update to 0.9.0-5
librabbitmq-debuginfo - update to 0.9.0-5
librabbitmq-devel - update to 0.9.0-5
librabbitmq-help - update to 0.9.0-5
librabbitmq - update to 0.9.0-5
rabbitmq-c-debuginfo - update to 0.10.0-150300.5.6.1
librabbitmq4 - update to 0.10.0-150300.5.6.1
rabbitmq-c-tools-debuginfo - update to 0.10.0-150300.5.6.1
rabbitmq-c-tools - update to 0.10.0-150300.5.6.1
librabbitmq4-debuginfo - update to 0.10.0-150300.5.6.1
rabbitmq-c-debugsource - update to 0.10.0-150300.5.6.1
librabbitmq-devel - update to 0.10.0-150300.5.6.1
librabbitmq - addressed in versions 0.11.0-7.0.1, 0.13.0-3
librabbitmq-devel - addressed in versions 0.11.0-7.0.1, 0.13.0-3
librabbitmq-doc - addressed in versions 0.11.0-7.0.1, 0.13.0-3
Storage Ceph - update to 6.1z3

• https://github.com/alanxz/rabbitmq-c/issues/575
• https://github.com/alanxz/rabbitmq-c/pull/781

• Insufficiently protected credentials in RabbitMQ C client library
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 9 update for librabbitmq
• Red Hat Enterprise Linux 8 update for librabbitmq
• SUSE update for rabbitmq-c
• openEuler update for librabbitmq
• Insufficiently protected credentials in IBM Storage Ceph
• Anolis OS update for librabbitmq
• Anolis OS update for librabbitmq