Fedora 37 : mosquitto (2023-e7ed15ab9e)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e7ed15ab9e advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

Advisory ROSA-SA-2023-2225

software: pesign 116 WASP: ROSA-CHROME packageevrstring: pesign-116-1.src.rpm CVE-ID: CVE-2022-3560 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A flaw has been discovered in the design. The pesign package provides a systemd service used to run the pesign daemon. This service module runs a script to...

Advisory ROSA-SA-2023-2224

software: mosquitto 2.0.15 WASP: ROSA-CHROME packageevrstring: mosquitto-2.0.15-2.src.rpm CVE-ID: CVE-2021-34431 BDU-ID: 2022-01775 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Mosquitto message broker is related to incorrect processing of a CONNECT packet without will topic, will message i...

Denial Of Service (DoS)

mosquitto is vulnerable to Denial of Service DoS attacks. This vulnerability exists due to a flaw in the way Envoy handles certain requests. A remote attacker can exploit this vulnerability to cause Envoy to crash, which could lead to a denial of service attack...

Denial Of Service (DoS)

mosquitto is vulnerable to Denial of Service DoS attacks. This vulnerability exists due to a flaw in the way the broker handles certain messages. A remote attacker can exploit this vulnerability to cause the broker to leak memory, which could eventually lead to a denial of service attack...

Remote Code Execution (RCE)

mosquitto is vulnerable to a remote code execution vulnerability. This vulnerability exists due to a flaw in the way the library handles certain requests. A remote attacker can exploit this vulnerability to execute arbitrary code on the affected system...

PT-2023-5226

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.3.2 through 2.x before 2.0.16 Description: The issue is related to a memory leak in the broker of Eclipse Mosquitto. This memory leak can be exploited remotely when a client sends many QoS 2 messages with duplicat...

Information Disclosure

mosquitto is vulnerable to Information Disclosure. This vulnerability occurs when the dynamic security plugin is used and a client is revoked the ability to make subscriptions on a topic while it is offline. In this case, the existing subscriptions for that client are not revoked, which allows th...

CVE-2023-3321 Code Execution through Writable Mosquitto Configuration File

A vulnerability exists by allowing low-privileged users to read and update the data in various directories used by the Zenon system. An attacker could exploit the vulnerability by using specially crafted programs to exploit the vulnerabilities by allowing them to run on the zenon installed hosts...

Juniper Junos OS Multiple Vulnerabilities (JSA71655)

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA71655 advisory. - The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject...

Security Bulletin: IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to Eclipse Mosquitto (CVE-2021-41039, CVE-2021-34432, CVE-2021-34431)

Summary IBM App Connect Enterprise & IBM Integration Bus are vulnerable to a denial of service due to Eclipse Mosquitto CVE-2021-41039, CVE-2021-34432, CVE-2021-34431 The fix includes Eclipse Mosquitto v2.0.15 Vulnerability Details CVEID:CVE-2021-41039 DESCRIPTION: Eclipse Mosquitto is vulnerable...

Eclipse Mosquitto 安全漏洞

Eclipse Mosquitto is a suite of open source message broker software from the Eclipse Foundation. A security vulnerability exists in Eclipse Mosquitto. No information about this vulnerability is available at this time, please stay tuned to CNNVD or vendor announcements...

PT-2023-35698 · Mosquitto · Mosquitto

Name of the Vulnerable Software and Affected Versions: mosquitto affected versions not specified Description: A heap buffer overflow read issue has been identified. The crash occurs in the mosquitto strdup function, which is called by config read file core and config read file. Recommendations: A...

Debian: Security Advisory (DLA-961-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2023-35941 · Mosquitto · Mosquitto

Name of the Vulnerable Software and Affected Versions: mosquitto affected versions not specified Description: A heap-use-after-free READ 8 crash has been identified. The crash occurs in the config cleanup function, which is called by mosquitto fuzz main and run broker. Recommendations: At the...

SUSE CVE-2017-7651

In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol...

SUSE CVE-2017-7650

In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '' or '+'. This allows locally or remotely connected clients to access MQTT topics that they do have the rights to. The same issue may be present in third party authentication/access...

SUSE CVE-2017-7653

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial ...

SUSE CVE-2017-7652

In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available default limit...

SUSE CVE-2017-7654

In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker...