SB2023112143 - Ubuntu update for mosquitto

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023112143

SB2023112143 - Ubuntu update for mosquitto

Published: November 21, 2023

Security Bulletin ID SB2023112143
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Memory leak (CVE-ID: CVE-2021-34431)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the broker. A remote authenticated attacker can send a specially crafted CONNECT message and perform denial of service attack.


2) Improper Authorization (CVE-ID: CVE-2021-34434)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to a subscriptions revoke flaw when using the dynamic security plugin. A remote attacker can send a specially crafted request and obtain subscriptions information.


3) Input validation error (CVE-ID: CVE-2021-41039)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted CONNECT packets containing lots of "user properties" and perform a denial of service (DoS) attack.


4) Resource exhaustion (CVE-ID: CVE-2023-0809)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send malicious initial packets that are not CONNECT packets, trigger memory exhaustion and perform a denial of service (DoS) attack.


5) Memory leak (CVE-ID: CVE-2023-3592)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when processing v5 CONNECT packets. A remote attacker can force the application to leak memory by sending messages with invalid property types.


6) Memory leak (CVE-ID: CVE-2023-28366)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due memory leak in broker. A remote client can send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands, which results in memory leak and denial of service condition.


Remediation

Install update from vendor's website.

References