PT-2019-4894 · Eclipse+3 · Eclipse Mosquitto+3

Roger Light · Published 2019-09-19 · Updated 2024-08-09 · CVE-2019-11779

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.5.0 through 1.6.5

Description The issue is related to insufficient exception state checking, which can be exploited by a remote attacker to cause a denial of service. This can happen when a malicious MQTT client sends a SUBSCRIBE packet containing a topic with approximately 65400 or more '/' characters, leading to a stack overflow.

Recommendations For Eclipse Mosquitto versions 1.5.0 through 1.6.5, consider restricting the length of topics in SUBSCRIBE packets to prevent stack overflows until a patch is available. As a temporary workaround, restrict access to the SUBSCRIBE functionality to minimize the risk of exploitation.

Fix

Improper Check for Exceptional Conditions

Uncontrolled Recursion

Weakness Enumeration

CWE-754

CWE-674

Related Identifiers

ALT-PU-2020-3477

ALT-PU-2020-3496

ALT-PU-2024-10879

BDU:2020-01486

CVE-2019-11779

DLA-1972-1

DSA-4570-1

MGASA-2019-0345

OPENSUSE-SU-2019:2206-1

OPENSUSE-SU-2019:2247-1

OPENSUSE-SU-2019_2206-1

OPENSUSE-SU-2024:11057-1

Affected Products

Alt Linux

Eclipse Mosquitto

Suse

Ubuntu

References · 54

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11779 · Vendor Advisory
• https://usn.ubuntu.com/4137-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.html · Vendor Advisory
• https://debian.org/security/2019/dsa-4570 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:2247-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2020-3477 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0345.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11778 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1972-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1972-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7655 · Security Note