CVE-2017-7654: High severity Eclipse Mosquitto vulnerability
In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-7654?
CVE-2017-7654 is a Memory Leak vulnerability found within the Mosquitto Broker in Eclipse Mosquitto 1.4.15 and earlier.
How can the Memory Leak vulnerability in CVE-2017-7654 be exploited?
Unauthenticated clients can exploit the Memory Leak vulnerability in CVE-2017-7654 by sending crafted CONNECT packets, leading to a denial of service in the Mosquitto Broker.
What is the severity of CVE-2017-7654?
CVE-2017-7654 has a severity rating of high, with a score of 7.5.
Which versions of Eclipse Mosquitto are affected by CVE-2017-7654?
Eclipse Mosquitto versions 1.4.15 and earlier are affected by CVE-2017-7654.
How can I fix the Memory Leak vulnerability in CVE-2017-7654?
To fix the Memory Leak vulnerability in CVE-2017-7654, update to the following versions: 1.4.15-2ubuntu0.18.04.3 (for Ubuntu Bionic), 1.4.15-2ubuntu0.18.10.3 (for Ubuntu Cosmic), 1.5.4-1 (for Ubuntu upstream), 1.4.8-1ubuntu0.16.04.7 (for Ubuntu Xenial), or 1.5.7-1+deb10u1, 2.0.11-1, 2.0.11-1+deb11u1, 2.0.11-1.2, 2.0.11-1.2+deb12u1, or 2.0.18-1 (for Debian).