Memory leak in Eclipse Mosquitto - CVE-2023-28366

Vulnerability identifier: #VU79936

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-28366

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform DoS attack on the target system.

The vulnerability exists due memory leak in broker. A remote client can send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands, which results in memory leak and denial of service condition.

Eclipse Mosquitto
Red Hat Satellite
IBM Integration Bus
Juniper Cloud Native Router
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Fedora
Ubuntu
openEuler
mosquitto (Ubuntu package)
rubygem-foreman_leapp (Red Hat package)
satellite-convert2rhel-toolkit (Red Hat package)
createrepo_c (Red Hat package)
rubygem-grpc (Red Hat package)
mosquitto (Debian package)
mosquitto
mosquitto-devel
mosquitto-debugsource
mosquitto-debuginfo
app-misc/mosquitto
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
satellite-clone (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
ansible-collection-redhat-satellite (Red Hat package)
python-pulp-rpm (Red Hat package)
rubygem-google-protobuf (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
Junos cRPD

Install updates from vendor's website.

Eclipse Mosquitto - update to 2.0.16
Red Hat Satellite - update to 6.14.2
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1
rubygem-foreman_leapp (Red Hat package) - update to 0.1.13-2.el8sat
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
createrepo_c (Red Hat package) - update to 1.0.2-2.el8pc
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
mosquitto (Debian package) - addressed in versions 2.0.11-1+deb11u1, 2.0.11-1.2+deb12u1
mosquitto - update to 2.0.16-1
mosquitto-devel - update to 2.0.16-1
mosquitto-debugsource - update to 2.0.16-1
mosquitto-debuginfo - update to 2.0.16-1
app-misc/mosquitto - update to 2.0.17
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
mosquitto - addressed in versions 2.0.17-1.el9, 2.0.17-1.fc37, 2.0.17-1.fc39, 2.0.21-1.fc42
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
satellite-clone (Red Hat package) - update to 3.5.0-1.el8sat
foreman (Red Hat package) - addressed in versions 3.5.1.24-1.el8sat, 3.7.0.11-2.el8sat
foreman-installer (Red Hat package) - addressed in versions 3.5.2.7-1.el8sat, 3.7.0.7-1.el8sat
ansible-collection-redhat-satellite (Red Hat package) - update to 3.9.0-3.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.19-2.el8pc
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
rubygem-katello (Red Hat package) - addressed in versions 4.7.0.36-1.el8sat, 4.9.0.21-1.el8sat
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - addressed in versions 6.13.7-1.el8sat, 6.14.2-1.el8sat
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
IBM Integration Bus - update to 10.1.0.2
rubygem-foreman_bootdisk (Red Hat package) - addressed in versions 21.0.5-1.el8sat, 21.2.1-1.el8sat
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://mosquitto.org/blog/2023/08/version-2-0-16-released/

• Multiple vulnerabilities in Eclipse Mosquitto
• Fedora EPEL 9 update for mosquitto
• Fedora 39 update for mosquitto
• Fedora 37 update for mosquitto
• Debian update for mosquitto
• Multiple vulnerabilities in IBM Integration Bus
• Ubuntu update for mosquitto
• Gentoo update for Eclipse Mosquitto
• Multiple vulnerabilities in Red Hat Satellite 6.14
• Multiple vulnerabilities in Red Hat Satellite 6.13 for RHEL 8
• openEuler 22.03 LTS SP1 update for mosquitto
• openEuler 22.03 LTS SP2 update for mosquitto
• openEuler 22.03 LTS update for mosquitto
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD
• Fedora 42 update for mosquitto