CVE-2022-31008: Predictable credential obfuscation seed value used in rabbitmq-server
Vulnerability summary
CVE-2022-31008 is a high (CVSS 7.5) Use of Insufficiently Random Values vulnerability in broadcom rabbitmq_server. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities.
Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-10-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
- CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse2 products
- rabbitmq-server&distro=openSUSE Leap 15.3< 3.8.11-150300.3.11.1
- rabbitmq-server&distro=openSUSE Leap 15.4< 3.8.11-150300.3.11.1
Suse2 products
- rabbitmq-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 3.8.11-150300.3.11.1
- rabbitmq-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 3.8.11-150300.3.11.1
Broadcom1 product
- rabbitmq_server≥ 3.9.0, < 3.9.18 | ≥ 3.10.0, < 3.10.2
Debian1 product
- rabbitmq-server< 3.10.8-1
Rabbitmq1 product
- rabbitmq-server< 3.8.32 | ≥ 3.9.0, < 3.9.18 | ≥ 3.10.0, < 3.10.2
Ubuntu1 product
- brokerAll versions (No fix recorded)
Vmware1 product
- rabbitmq< 3.8.32
7 vendors · 9 products
References
8 links- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8REPORTThird Party Advisory
