CVE-2023-35789

Name of the Vulnerable Software and Affected Versions C AMQP client library (aka rabbitmq-c) versions 0.13.0 and earlier

Description An issue was discovered in the C AMQP client library for RabbitMQ, where credentials can only be entered on the command line and are thus visible to local attackers by listing a process and its arguments. This is related to insufficient protection of registration data, which can allow an attacker to gain access to confidential data.

Recommendations For versions 0.13.0 and earlier, consider restricting access to command line arguments to minimize the risk of exploitation. As a temporary workaround, avoid using command line tools like amqp-publish or amqp-consume that require entering credentials directly on the command line until a patch is available.