Memory leak in Eclipse Mosquitto - CVE-2023-3592

Vulnerability identifier: #VU79938

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3592

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak when processing v5 CONNECT packets. A remote attacker can force the application to leak memory by sending messages with invalid property types.

Eclipse Mosquitto
Red Hat Satellite
IBM Integration Bus
Juniper Cloud Native Router
Debian Linux
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Fedora
openEuler
Ubuntu
mosquitto (Ubuntu package)
rubygem-foreman_leapp (Red Hat package)
satellite-convert2rhel-toolkit (Red Hat package)
createrepo_c (Red Hat package)
mosquitto-devel
mosquitto-debugsource
mosquitto
mosquitto-debuginfo
rubygem-grpc (Red Hat package)
mosquitto (Debian package)
app-misc/mosquitto
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
satellite-clone (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
ansible-collection-redhat-satellite (Red Hat package)
python-pulp-rpm (Red Hat package)
rubygem-google-protobuf (Red Hat package)
candlepin (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-puma (Red Hat package)
rubygem-sidekiq (Red Hat package)
satellite (Red Hat package)
rubygem-kafo (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)
Junos cRPD

Install updates from vendor's website.

Eclipse Mosquitto - update to 2.0.16
Red Hat Satellite - update to 6.14.2
mosquitto (Ubuntu package) - addressed in versions Ubuntu Pro, 2.0.11-1ubuntu1.1, 2.0.11-1.2ubuntu0.1
rubygem-foreman_leapp (Red Hat package) - update to 0.1.13-2.el8sat
satellite-convert2rhel-toolkit (Red Hat package) - update to 1.0.1-1.el8sat
createrepo_c (Red Hat package) - update to 1.0.2-2.el8pc
mosquitto-devel - addressed in versions 1.6.15-7, 2.0.16-1
mosquitto-debugsource - addressed in versions 1.6.15-7, 2.0.16-1
mosquitto - addressed in versions 1.6.15-7, 2.0.16-1
mosquitto-debuginfo - addressed in versions 1.6.15-7, 2.0.16-1
rubygem-grpc (Red Hat package) - update to 1.58.0-1.el8sat
mosquitto (Debian package) - addressed in versions 2.0.11-1+deb11u1, 2.0.11-1.2+deb12u1
app-misc/mosquitto - update to 2.0.17
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
mosquitto - addressed in versions 2.0.17-1.el9, 2.0.17-1.fc37, 2.0.17-1.fc39
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
satellite-clone (Red Hat package) - update to 3.5.0-1.el8sat
foreman (Red Hat package) - addressed in versions 3.5.1.24-1.el8sat, 3.7.0.11-2.el8sat
foreman-installer (Red Hat package) - addressed in versions 3.5.2.7-1.el8sat, 3.7.0.7-1.el8sat
ansible-collection-redhat-satellite (Red Hat package) - update to 3.9.0-3.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.19-2.el8pc
rubygem-google-protobuf (Red Hat package) - update to 3.24.3-1.el8sat
candlepin (Red Hat package) - update to 4.3.11-1.el8sat
rubygem-katello (Red Hat package) - addressed in versions 4.7.0.36-1.el8sat, 4.9.0.21-1.el8sat
rubygem-puma (Red Hat package) - update to 6.3.1-1.el8sat
rubygem-sidekiq (Red Hat package) - update to 6.5.12-1.el8sat
satellite (Red Hat package) - addressed in versions 6.13.7-1.el8sat, 6.14.2-1.el8sat
rubygem-kafo (Red Hat package) - update to 7.2.0-1.el8sat
puppetserver (Red Hat package) - update to 7.14.0-1.el8sat
puppet-agent (Red Hat package) - update to 7.27.0-1.el8sat
IBM Integration Bus - update to 10.1.0.2
rubygem-foreman_bootdisk (Red Hat package) - addressed in versions 21.0.5-1.el8sat, 21.2.1-1.el8sat
Juniper Cloud Native Router - update to 23.4R1
Junos cRPD - update to 23.4R1

• https://mosquitto.org/blog/2023/08/version-2-0-16-released/

• Multiple vulnerabilities in Eclipse Mosquitto
• Fedora EPEL 9 update for mosquitto
• Fedora 39 update for mosquitto
• Fedora 37 update for mosquitto
• Debian update for mosquitto
• Multiple vulnerabilities in IBM Integration Bus
• Ubuntu update for mosquitto
• Gentoo update for Eclipse Mosquitto
• Multiple vulnerabilities in Red Hat Satellite 6.14
• Multiple vulnerabilities in Red Hat Satellite 6.13 for RHEL 8
• openEuler 20.03 LTS SP1 update for mosquitto
• openEuler 22.03 LTS update for mosquitto
• openEuler 22.03 LTS SP1 update for mosquitto
• openEuler 22.03 LTS SP2 update for mosquitto
• openEuler 20.03 LTS SP3 update for mosquitto
• openEuler 20.03 LTS SP4 update for mosquitto
• Multiple vulnerabilities in Juniper Cloud Native Router
• Multiple vulnerabilities in Juniper Networks Junos cRPD