Input validation error - CVE-2018-12543
Published: November 15, 2018 / Updated: August 4, 2020
Vulnerability identifier: #VU33490
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12543
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit.
Affected software
Arch Linux
Fedora
mosquitto (Alpine package)
mosquitto
Fedora
mosquitto (Alpine package)
mosquitto
How to mitigate CVE-2018-12543
Install update from vendor's website.
mosquitto (Alpine package) - update to 1.5.3-r0
mosquitto - addressed in versions 1.5.3-1.el7, 1.5.3-1.fc27, 1.5.3-1.fc28, 1.5.3-1.fc29
mosquitto - addressed in versions 1.5.3-1.el7, 1.5.3-1.fc27, 1.5.3-1.fc28, 1.5.3-1.fc29