SB2018101411 - Fedora EPEL 7 update for mosquitto

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018101411

SB2018101411 - Fedora EPEL 7 update for mosquitto

Published: October 14, 2018 Updated: April 24, 2025

Security Bulletin ID SB2018101411
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2018-12543)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit.


2) Input validation error (CVE-ID: CVE-2017-7653)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of not valid UTF-8 string. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.


3) Memory leak (CVE-ID: CVE-2017-7654)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak. A remote attacker can send specially crafted CONNECT packets to force the application to leak memory and perform denial of service attack.


Remediation

Install update from vendor's website.

References