Vulnerability GHSA-33mj-cw25-m34h

Summary

A structural security weakness exists in the AMQP client's TLS configuration generator (tlsConfigFromURI). When constructing a *tls.Config object from an amqps:// connection URI, the library initializes the structure without explicitly defining the MinVersion field.

While modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go toolchains (Go < 1.18), or if a future toolchain introduces fallback behavior, the client could silently negotiate obsolete and insecure TLS 1.0 or TLS 1.1 protocols during connection handshakes with a compromised or malicious AMQP broker.

Attack Vector

An attacker performing a network-level downgrade attack can intercept a client connection built under a legacy toolchain:

1. Interception: A client application compiled on a legacy pipeline attempts to establish an encrypted connection to an AMQP broker.
2. Protocol Downgrade: The attacker intercepts the TLS Client Hello handshake and forces a downgrade negotiation to TLS 1.0.
3. Cryptographic Exploitation: Because MinVersion was never explicitly locked to tls.VersionTLS12 by the library, the client accepts the weak cipher suites, allowing the attacker to monitor or manipulate the underlying AMQP session data.