PT-2017-11602 · Mqtt · Mqtt.Js

Bintatsu Noda + 2 · Published 2017-12-27 · Updated 2019-10-03 · CVE-2017-10910

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MQTT.js versions prior to 2.15.0

Description The issue lies in the handling of PUBLISH tickets, which may lead to an attacker causing a denial-of-service condition. This occurs because affected versions of mqtt do not properly handle PUBLISH packets returning from the server. However, if the only connected servers are trusted and guaranteed not to be under the control of a malicious actor, the vulnerability is completely mitigated.

Recommendations Update to version 2.15.0 or later. As a temporary workaround, consider restricting access to untrusted MQTT servers to minimize the risk of exploitation.

Fix

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2017-10910

GHSA-H9MJ-FGHC-664W

Affected Products

Mqtt.Js

References · 10

• https://github.com/mqttjs/MQTT.js/commit/403ba53b838f2d319a0c0505a045fe00239e9923 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-10910 · Security Note
• https://osv.dev/vulnerability/GHSA-h9mj-fghc-664w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10910 · Vendor Advisory
• https://github.com/mqttjs/MQTT.js/releases/tag/v2.15.0 · Note
• https://github.com/mqttjs/MQTT.js · Note
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/357.json · Note
• https://jvn.jp/en/jp/JVN45494523/index.html · Note
• https://github.com/advisories/GHSA-h9mj-fghc-664w · Note
• https://npmjs.com/advisories/555 · Note