PT-2017-11602 · Mqtt · Mqtt.Js

Bintatsu Noda + 2 · Publicado 2017-12-27 · Atualizado 2019-10-03 · CVE-2017-10910

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MQTT.js versions prior to 2.15.0

Description The issue lies in the handling of PUBLISH tickets, which may lead to an attacker causing a denial-of-service condition. This occurs because affected versions of mqtt do not properly handle PUBLISH packets returning from the server. However, if the only connected servers are trusted and guaranteed not to be under the control of a malicious actor, the vulnerability is completely mitigated.

Recommendations Update to version 2.15.0 or later. As a temporary workaround, consider restricting access to untrusted MQTT servers to minimize the risk of exploitation.

Correção

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CVE-2017-10910

GHSA-H9MJ-FGHC-664W

Produtos afetados

Mqtt.Js

Referências · 10

• https://github.com/mqttjs/MQTT.js/commit/403ba53b838f2d319a0c0505a045fe00239e9923 · Correção
• https://github.com/mqttjs/MQTT.js/releases/tag/v2.15.0 · Nota
• https://github.com/mqttjs/MQTT.js · Nota
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/357.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-10910 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-h9mj-fghc-664w · Aviso do Fabricante
• https://jvn.jp/en/jp/JVN45494523/index.html · Nota
• https://github.com/advisories/GHSA-h9mj-fghc-664w · Nota
• https://osv.dev/vulnerability/CVE-2017-10910 · Aviso do Fabricante
• https://npmjs.com/advisories/555 · Nota