CVE-2023-35789: Insufficiently Protected Credentials

June 16, 2023 (updated June 26, 2023)

An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments.

References

github.com/alanxz/rabbitmq-c/issues/575
github.com/alanxz/rabbitmq-c/pull/781
nvd.nist.gov/vuln/detail/CVE-2023-35789

Detect and mitigate CVE-2023-35789 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →