Input validation error in Eclipse Mosquitto - CVE-2021-41039

Vulnerability identifier: #VU58484

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-41039

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send specially crafted CONNECT packets containing lots of "user properties" and perform a denial of service (DoS) attack.

Eclipse Mosquitto
Juniper Cloud Native Router
Debian Linux
openEuler
Ubuntu
IBM App Connect Enterprise
mosquitto (Ubuntu package)
mosquitto
mosquitto-debugsource
mosquitto-devel
mosquitto-debuginfo
mosquitto (Debian package)
Junos cRPD

Install updates from vendor's website.

Eclipse Mosquitto - update to 2.0.12
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1
mosquitto - update to 1.6.15-5
mosquitto-debugsource - update to 1.6.15-5
mosquitto-devel - update to 1.6.15-5
mosquitto-debuginfo - update to 1.6.15-5
mosquitto (Debian package) - addressed in versions 2.0.11-1+deb11u1, 2.0.11-1.2+deb12u1
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=575314

• Denial of service in Eclipse Mosquitto
• Multiple vulnerabilities in IBM App Connect Enterprise
• Debian update for mosquitto
• Ubuntu update for mosquitto
• openEuler update for mosquitto
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD