Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-rabbitmq-amqp091-go | 1.14.0-1 | — |
| Debian 13 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Debian 12 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-rabbitmq-amqp091-go | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | keda | No fix yet | — |
| Azure Linux 3 | telegraf | 1.31.0-34 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rabbitmq/amqp091-go | < 1.13.0 | 1.13.0 | GHSA-33mj-cw25-m34h |