PT-2018-8421 · Eclipse+1 · Eclipse Mosquitto+1

Roger Light · Published 2018-04-25 · Updated 2019-10-09 · CVE-2017-7652

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto version 1.4.14

Description The issue occurs when a Mosquitto instance is running with a configuration file and a HUP signal is sent to the server, triggering a configuration reload from disk. If there are numerous clients connected, exhausting the available file descriptors/sockets (typically 1024 on Linux), the configuration file cannot be opened.

Recommendations For Eclipse Mosquitto version 1.4.14, consider increasing the file descriptor limit to prevent exhaustion when numerous clients are connected, or implement a mechanism to handle the reload of the configuration file without requiring additional file descriptors. As a temporary workaround, consider restricting the number of clients that can connect to the server to prevent file descriptor exhaustion when the configuration is reloaded.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

ALT-PU-2018-2291

CVE-2017-7652

DLA-1334-1

DLA-1409-1

DSA-4325-1

OPENSUSE-SU-2024:11057-1

Affected Products

Alt Linux

Eclipse Mosquitto

References · 17

• https://ubuntu.com/security/CVE-2017-7652 · Vendor Advisory
• https://debian.org/security/2018/dsa-4325 · Vendor Advisory
• https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7652 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-7652 · Security Note
• https://osv.dev/vulnerability/DLA-1409-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-7652 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7652 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4325-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7652 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7652 · Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html · Note
• https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html · Note
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102 · Note