Описание
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2.0.21-1 |
| esm-apps/bionic | released | 1.4.15-2ubuntu0.18.04.3+esm2 |
| esm-apps/focal | released | 1.6.9-1ubuntu0.1~esm2 |
| esm-apps/jammy | released | 2.0.11-1ubuntu1.2 |
| esm-apps/noble | released | 2.0.18-1ubuntu0.1~esm1 |
| esm-apps/xenial | released | 1.4.8-1ubuntu0.16.04.7+esm2 |
| esm-infra-legacy/trusty | released | 0.15-2+deb7u3ubuntu0.1+esm1 |
| focal | ignored | end of standard support, was needed |
| jammy | released | 2.0.11-1ubuntu1.2 |
| noble | needed |
Показывать по
Ссылки на источники
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a maliciou ...
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
Уязвимость брокера сообщений Eclipse Mosquitto, связанная с переполнением буфера в динамической памяти, позволяющая нарушителю получить доступ к конфиденциальной информации
EPSS
9.8 Critical
CVSS3