[GHSA-27gv-rfvv-22mv] RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

[d3fenestrator]

Updates

• Affected products

Comments
github.com/streadway/amqp is the unmaintained predecessor of github.com/rabbitmq/amqp091-go; its README says "NOT ACTIVELY MAINTAINED. Consider using rabbitmq/amqp091-go". amqp091-go is a fork and shares this code.

The issue fixed in amqp091-go by rabbitmq/amqp091-go@fa013b8 is present in the latest streadway/amqp release (v1.1.0): https://github.com/streadway/amqp/blob/v1.1.0/auth.go#L20-L23 and https://github.com/streadway/amqp/blob/v1.1.0/auth.go#L36-L39

Both PlainAuth and AMQPlainAuth expose Username and Password as exported fields and define no String() method, so formatting them (e.g. %v / %+v in logs, including through Config.SASL) prints the password in plaintext. The fix adds String() methods that redact the password. v1.0.0 contains the same code.

streadway/amqp has no release containing the fix, so all versions (<= 1.1.0) are affected and there is no patched version.

[github]

Hi there @suchitd! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory