PT-2023-9154 · Eclipse+4 · Eclipse Mosquitto+4

Publicado 2023-10-01 · Atualizado 2025-03-10 · CVE-2023-0809

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions prior to 2.0.16

Description The issue is related to excessive memory allocation based on malicious initial packets that are not CONNECT packets. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.0.16, update to version 2.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the broker to minimize the risk of exploitation.

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-789

Identificadores relacionados

ALT-PU-2025-1041

ALT-PU-2025-3746

BDU:2024-04210

CVE-2023-0809

DSA-5511-1

OESA-2023-1716

OESA-2023-1717

OESA-2023-1718

OPENSUSE-SU-2024:13546-1

RHSA-2024:0797

RHSA-2024:1061

ROSA-SA-2025-2633

USN-6492-1

Produtos afetados

Alt Linux

Eclipse Mosquitto

Linuxmint

Red Os

Ubuntu

Referências · 31

• https://ubuntu.com/security/CVE-2023-3592 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2023-1718 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-0809 · Nota de Segurança
• https://ubuntu.com/security/CVE-2021-34431 · Aviso do Fabricante
• https://t.me/cvenotify/66513 · Publicação no Telegram
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2633 · Nota
• https://osv.dev/vulnerability/OESA-2023-1716 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6492-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-0809 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-04210 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-28366 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202401-09 · Nota
• https://redos.red-soft.ru/support/secure · Nota
• https://mosquitto.org/blog/2023/08/version-2-0-16-released · Nota
• https://security.alpinelinux.org/vuln/CVE-2023-0809 · Nota