CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-34432
https://notcve.org/view.php?id=CVE-2021-34432
In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0. En Eclipse Mosquitto versiones 2.07 y anteriores, el servidor se bloqueará si el cliente intenta enviar un paquete PUBLISH con longitud de tema = 0 • https://bugs.eclipse.org/bugs/show_bug.cgi?id=574141 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 35%CPEs: 10EXPL: 0CVE-2019-11779
https://notcve.org/view.php?id=CVE-2019-11779
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur. En Eclipse Mosquitto versiones 1.5.0 hasta 1.6.5 incluyéndola, si un cliente MQTT malicioso envía un paquete SUBSCRIBE que contiene un tema que consta de aproximadamente 65400 o más caracteres '/', es decir, el separador de jerarquía de temas, entonces ocurrirá un desbordamiento de la pila. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.html http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.html https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160 https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7 https:&# • CWE-674: Uncontrolled Recursion CWE-754: Improper Check for Unusual or Exceptional Conditions •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-7655
https://notcve.org/view.php?id=CVE-2017-7655
In Eclipse Mosquitto version from 1.0 to 1.4.15, a Null Dereference vulnerability was found in the Mosquitto library which could lead to crashes for those applications using the library. En Eclipse Mosquitto, desde la versión 1.0 hasta la 1.4.15, se ha descubierto una vulnerabilidad de desreferencia de puntero null en la biblioteca Mosquitto que podría conducir a cierres inesperados de las aplicaciones que la emplean. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=533775 https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html https://lists.debian.org/debian-lts-announce/2021/10/msg00022.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12546
https://notcve.org/view.php?id=CVE-2018-12546
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed. En Eclipse Mosquitto, desde la versión 1.0 hasta la 1.5.5 (incluidas), cuando un cliente publica un mensaje retenido en un tema y luego se le niega el acceso a dicho tema, el mensaje retenido se publicará de todas formas a los clientes que se suscriban a ese tema en el futuro. En algunas aplicaciones, esto podría resultar en que los clientes sean capaces de provocar efectos que no les están permitidos de otra forma. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127 • CWE-284: Improper Access Control CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-12551
https://notcve.org/view.php?id=CVE-2018-12551
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. • https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401 https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html • CWE-287: Improper Authentication CWE-703: Improper Check or Handling of Exceptional Conditions •