PT-2023-24436 · Nanomq · Nanomq

Zuoyuanp · Publicado 2023-06-08 · Atualizado 2025-01-06 · CVE-2023-33657

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NanoMQ version 0.17.2

Description A use-after-free issue exists due to improper data tracing. This can be triggered by calling the function nni mqtt msg get publish property() in the file mqtt msg.c, potentially allowing an attacker to cause a denial of service attack.

Recommendations For NanoMQ version 0.17.2, consider disabling the nni mqtt msg get publish property() function as a temporary workaround until a patch is available.

Exploit

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

CVE-2023-33657

Produtos afetados

Nanomq

Referências · 7

• 🔥 https://github.com/emqx/nanomq/issues/1165#issue-1668648319 · Exploit
• https://github.com/emqx/nanomq · Nota
• https://github.com/emqx/nanomq/pull/1187 · Correção
• https://t.me/cibsecurity/65068 · Publicação no Telegram
• https://t.me/cvenotify/106472 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-33657 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-33657 · Aviso do Fabricante