Memory leak in Eclipse Mosquitto - CVE-2021-34431
Published: July 29, 2021
Vulnerability identifier: #VU55435
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-34431
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in the broker. A remote authenticated attacker can send a specially crafted CONNECT message and perform denial of service attack.
Affected software
Eclipse Mosquitto
IBM App Connect Enterprise
Ubuntu
mosquitto (Ubuntu package)
IBM App Connect Enterprise
Ubuntu
mosquitto (Ubuntu package)
How to mitigate CVE-2021-34431
Install updates from vendor's website.
Eclipse Mosquitto - update to 2.0.11
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1