PT-2018-8421 · Eclipse+1 · Eclipse Mosquitto+1

Roger Light · Publicado 2018-04-25 · Atualizado 2019-10-09 · CVE-2017-7652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto version 1.4.14

Description The issue occurs when a Mosquitto instance is running with a configuration file and a HUP signal is sent to the server, triggering a configuration reload from disk. If there are numerous clients connected, exhausting the available file descriptors/sockets (typically 1024 on Linux), the configuration file cannot be opened.

Recommendations For Eclipse Mosquitto version 1.4.14, consider increasing the file descriptor limit to prevent exhaustion when numerous clients are connected, or implement a mechanism to handle the reload of the configuration file without requiring additional file descriptors. As a temporary workaround, consider restricting the number of clients that can connect to the server to prevent file descriptor exhaustion when the configuration is reloaded.

Correção

Enumeração de Fraquezas

CWE-789

Identificadores relacionados

ALT-PU-2018-2291

CVE-2017-7652

DLA-1334-1

DLA-1409-1

DSA-4325-1

OPENSUSE-SU-2024:11057-1

Produtos afetados

Alt Linux

Eclipse Mosquitto

Referências · 17

• https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html · Nota
• https://ubuntu.com/security/CVE-2017-7652 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html · Nota
• https://debian.org/security/2018/dsa-4325 · Aviso do Fabricante
• https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652 · Aviso do Fabricante
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7652 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-7652 · Nota de Segurança
• http://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652 · Nota
• https://osv.dev/vulnerability/DLA-1409-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2017-7652 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7652 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4325-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7652 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-7652 · Aviso do Fabricante