PT-2019-12495 · Eclipse+1 · Eclipse Mosquitto+1

Roger Light · Published 2019-09-18 · Updated 2024-08-09 · CVE-2019-11778

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.6.0 through 1.6.4

Description A use after free error occurs when an MQTT v5 client connects to the affected Eclipse Mosquitto versions, sets a last will and testament, a will delay interval, and a session expiry interval, where the will delay interval is longer than the session expiry interval. This error has the potential to cause a crash in certain situations.

Recommendations For Eclipse Mosquitto versions 1.6.0 through 1.6.4, ensure that the will delay interval is not set longer than the session expiry interval to prevent the use after free error. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-3477

ALT-PU-2020-3496

ALT-PU-2024-10879

CVE-2019-11778

OPENSUSE-SU-2024:11057-1

Affected Products

Alt Linux

Eclipse Mosquitto

References · 12

• https://errata.altlinux.org/ALT-PU-2020-3496 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2024-10879 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=551162 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11778 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01486 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11778 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11778 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3477 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11779 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11778 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11778 · Security Note
• https://packages.altlinux.org/ru/vuln/CVE-2019-11778 · Note