AIKIDO-2026-960920
spring-rabbit-junit is vulnerable to Insertion of Sensitive Information into Log File
53
Medium Risk
This Affects:
spring-rabbit-junitTL;DR
spring-rabbit-junit embeds the configured admin password in the BrokerNotAliveException message when the management aliveness check fails. CI logs then contain that password whenever the broker is required and not alive. Anyone with log access can recover the credential. The patch removes the password from the exception text.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and RabbitMQ test support logs BrokerNotAliveException when the management aliveness check fails.
Background info
spring-rabbit-junit is vulnerable to Insertion of Sensitive Information into Log File in versions 0.0.1 - 4.0.4 and 4.1.0 - 4.1.0.
How to fix this
Upgrade the org.springframework.amqp:spring-rabbit-junit library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant