CVE-2018-1279 — RabbitMQ cluster compromise due to deterministically generated cookie

CVE-2018-1279

RabbitMQ cluster compromise due to deterministically generated cookie PUBLISHED

Description (CNA)

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports on any server in the MQ cluster can use this cookie to gain full control over the entire cluster.

Affected (CNA)

Vendor / product	Versions
Pivotal / RabbitMq for PCF	affected 1 before all versions*

CWE

No CWE identifiers supplied.

References

https://pivotal.io/security/cve-2018-1279

ADP enrichment

CVE

No English description supplied.

https://pivotal.io/security/cve-2018-1279