CVE-2017-7654

Reference Links

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=533493
• https://security-tracker.debian.org/tracker/CVE-2017-7654
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7654
• https://github.com/eclipse/mosquitto/commit/51ec5601c2ec523bf2973fdc1eca77335eafb8de
• https://security-tracker.debian.org/tracker/CVE-2017-7653
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911265
• https://lists.debian.org/debian-lts-announce/2018/09/msg00036.html
• https://www.debian.org/security/2018/dsa-4325
• https://usn.ubuntu.com/4023-1/
• https://launchpad.net/bugs/cve/CVE-2017-7654
• https://ubuntu.com/security/notices/USN-4023-1
• https://nvd.nist.gov/vuln/detail/CVE-2017-7654
• https://ubuntu.com/security/CVE-2017-7654

Parent vulnerabilities

(Appears in the following advisories)

• USN-4023-1

Frequently Asked Questions

• What is CVE-2017-7654?

  CVE-2017-7654 is a Memory Leak vulnerability found within the Mosquitto Broker in Eclipse Mosquitto 1.4.15 and earlier.

• How can the Memory Leak vulnerability in CVE-2017-7654 be exploited?

  Unauthenticated clients can exploit the Memory Leak vulnerability in CVE-2017-7654 by sending crafted CONNECT packets, leading to a denial of service in the Mosquitto Broker.

• What is the severity of CVE-2017-7654?

  CVE-2017-7654 has a severity rating of high, with a score of 7.5.

• Which versions of Eclipse Mosquitto are affected by CVE-2017-7654?

  Eclipse Mosquitto versions 1.4.15 and earlier are affected by CVE-2017-7654.

• How can I fix the Memory Leak vulnerability in CVE-2017-7654?

  To fix the Memory Leak vulnerability in CVE-2017-7654, update to the following versions: 1.4.15-2ubuntu0.18.04.3 (for Ubuntu Bionic), 1.4.15-2ubuntu0.18.10.3 (for Ubuntu Cosmic), 1.5.4-1 (for Ubuntu upstream), 1.4.8-1ubuntu0.16.04.7 (for Ubuntu Xenial), or 1.5.7-1+deb10u1, 2.0.11-1, 2.0.11-1+deb11u1, 2.0.11-1.2, 2.0.11-1.2+deb12u1, or 2.0.18-1 (for Debian).