The RabbitMQ Java client library versions before 5.33.0 have improper certificate validation due to the useSslProtocol() methods configuring a TrustEverythingTrustManager and disabling hostname verification. This causes the client to accept arbitrary server certificates, including self-signed ones. Consequently, a network attacker capable of intercepting TLS connections can impersonate the RabbitMQ broker and compromise the confidentiality and integrity of AMQP traffic. The issue is addressed in version 5.33.0 by switching to the JVM default trust store and enabling hostname verification, while retaining a development-only no-verification option.

An attacker with network interception capabilities can impersonate the RabbitMQ broker by presenting arbitrary or self-signed certificates. This enables the attacker to read and modify AMQP traffic that is assumed to be protected by TLS, undermining confidentiality and integrity of communications between Java/JVM-based applications and RabbitMQ nodes.

Upgrade to rabbitmq-java-client version 5.33.0 or later, where the vulnerability is fixed by enabling proper certificate validation and hostname verification by default. Avoid using the development-only no-verification helper in production environments. Patch status is not explicitly stated but the fix is included in version 5.33.0, so upgrading to this version or later is the recommended remediation.