Resource exhaustion in Eclipse Mosquitto - CVE-2023-0809

Vulnerability identifier: #VU79937

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0809

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can send malicious initial packets that are not CONNECT packets, trigger memory exhaustion and perform a denial of service (DoS) attack.

Eclipse Mosquitto
Red Hat Satellite
IBM Integration Bus
Juniper Cloud Native Router
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Fedora
Ubuntu
openEuler
mosquitto (Ubuntu package)
rubygem-foreman_leapp (Red Hat package)
satellite-convert2rhel-toolkit (Red Hat package)
createrepo_c (Red Hat package)
rubygem-grpc (Red Hat package)
mosquitto (Debian package)
mosquitto-devel
mosquitto
mosquitto-debugsource
mosquitto-debuginfo
app-misc/mosquitto
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
satellite-clone (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
ansible-collection-redhat-satellite (Red Hat package)
python-pulp-rpm (Red Hat package)
rubygem-google-protobuf (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
Junos cRPD

Install updates from vendor's website.

Eclipse Mosquitto - update to 2.0.16
Red Hat Satellite - update to 6.14.2
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1
rubygem-foreman_leapp (Red Hat package) - update to 0.1.13-2.el8sat
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
createrepo_c (Red Hat package) - update to 1.0.2-2.el8pc
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
mosquitto (Debian package) - addressed in versions 2.0.11-1+deb11u1, 2.0.11-1.2+deb12u1
mosquitto-devel - update to 2.0.16-1
mosquitto - update to 2.0.16-1
mosquitto-debugsource - update to 2.0.16-1
mosquitto-debuginfo - update to 2.0.16-1
app-misc/mosquitto - update to 2.0.17
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
mosquitto - addressed in versions 2.0.17-1.el9, 2.0.17-1.fc37, 2.0.17-1.fc39
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
satellite-clone (Red Hat package) - update to 3.5.0-1.el8sat
foreman (Red Hat package) - addressed in versions 3.5.1.24-1.el8sat, 3.7.0.11-2.el8sat
foreman-installer (Red Hat package) - addressed in versions 3.5.2.7-1.el8sat, 3.7.0.7-1.el8sat
ansible-collection-redhat-satellite (Red Hat package) - update to 3.9.0-3.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.19-2.el8pc
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
rubygem-katello (Red Hat package) - addressed in versions 4.7.0.36-1.el8sat, 4.9.0.21-1.el8sat
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - addressed in versions 6.13.7-1.el8sat, 6.14.2-1.el8sat
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
IBM Integration Bus - update to 10.1.0.2
rubygem-foreman_bootdisk (Red Hat package) - addressed in versions 21.0.5-1.el8sat, 21.2.1-1.el8sat
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://mosquitto.org/blog/2023/08/version-2-0-16-released/

• Multiple vulnerabilities in Eclipse Mosquitto
• Fedora EPEL 9 update for mosquitto
• Fedora 39 update for mosquitto
• Fedora 37 update for mosquitto
• Debian update for mosquitto
• Multiple vulnerabilities in IBM Integration Bus
• Ubuntu update for mosquitto
• Gentoo update for Eclipse Mosquitto
• Multiple vulnerabilities in Red Hat Satellite 6.14
• Multiple vulnerabilities in Red Hat Satellite 6.13 for RHEL 8
• openEuler 22.03 LTS SP1 update for mosquitto
• openEuler 22.03 LTS SP2 update for mosquitto
• openEuler 22.03 LTS update for mosquitto
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD