CyberRota Analysis
AI-GeneratedRabbitMQ amqp091-go versions prior to 1.13.0 are vulnerable due to improper TLS configuration, allowing connections to negotiate outdated TLS versions (1.0 or 1.1) instead of the secure TLS 1.2. This flaw can enable network attackers to compromise the confidentiality and integrity of AMQP messages and credentials. Organizations utilizing affected versions should prioritize upgrading to version 1.13.0 to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.