ALPINE-CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

UBUNTU-CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Memory corruption

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Security Bulletin: IBM MQ Explorer is affected by vulnerabilities in Eclipse Jetty (CVE-2023-26048, CVE-2023-26049)

Summary IBM MQ is affected by vulnerabilites in Eclipse Jetty. This is used in the IBM MQ Explorer. Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the HttpServletRequest.getParameter or...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Fedora 37 : mosquitto (2023-e7ed15ab9e)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-e7ed15ab9e advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function...

Fedora 38 : libwebsockets / mosquitto (2023-6a87c003c4)

The remote Fedora 38 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-6a87c003c4 advisory. 2.0.17 Broker: Fix maxqueuedmessages 0 stopping clients from receiving messages Fix maxinflightmessages not being set correctly. Apps: Fix...

Eclipse Mosquitto Security Vulnerability

Eclipse Mosquitto is the Eclipse Foundation's open source messaging agent software. A security vulnerability exists in Eclipse Mosquitto versions 1.3.2 through 2.0.16, which stems from incorrect handling of EAGAIN in the libc send function, a memory leak in the proxy, and a remote abuse of the...

CVE-2023-28366

CVE-2023-28366 affects the Eclipse Mosquitto broker (versions 1.3.2–2.x prior to 2.0.16). The issue is a memory leak caused by mishandling of EAGAIN from libc send when a client sends many QoS 2 messages with duplicate message IDs and the broker does not respond to PUBREC. This can enable remote ...

CVE-2023-41034

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...

CVE-2023-41034

The CVE-2023-41034 issue affects Eclipse Leshan: DDFFileParser, DefaultDDFFileValidator (and ObjectLoader) are vulnerable to XXE Attacks when parsing untrusted DDF files. The root cause is exposure to XML External Entities. Remediation is to upgrade to fixed versions 1.5.0 or 2.0.0-M13; upgrades ...

CVE-2023-41034 DDFFileParser in eclipse leshan is vulnerable to XXE Attacks

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...

CVE-2023-41034 DDFFileParser in eclipse leshan is vulnerable to XXE Attacks

Eclipse Leshan is a device management server and client Java implementation. In affected versions DDFFileParser and DefaultDDFFileValidator and so ObjectLoader are vulnerable to XXE Attacks. A DDF file is a LWM2M format used to store LWM2M object description. Leshan users are impacted only if the...

Eclipse Leshan 代码问题漏洞

Eclipse Leshan is a set of open source Java libraries from the Eclipse Foundation that can be used to develop your own Lightweight M2M server and client. Eclipse Leshan has a code issue vulnerability that stems from being subject to an XML External Entity XXE attack...

PT-2023-5313 · Eclipse · Eclipse Leshan

Name of the Vulnerable Software and Affected Versions: Eclipse Leshan versions prior to 1.5.0 Eclipse Leshan versions prior to 2.0.0-M13 Description: The issue is related to the incorrect restriction of XML links to external objects, which can allow a remote attacker to perform an XXE attack. Thi...

A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy.

In Eclipse Jetty, versions 9.2.x and older, 9.3.x all configurations, and 9.4.x non-default configuration with RFC2616 compliance enabled, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a...