First published: Tue Jun 05 2018(Updated: )
In Eclipse Mosquitto 1.4.15 and earlier, a Memory Leak vulnerability was found within the Mosquitto Broker. Unauthenticated clients can send crafted CONNECT packets which could cause a denial of service in the Mosquitto Broker.
Credit: emo@eclipse.org emo@eclipse.org
Affected Software | Affected Version | How to fix |
---|---|---|
Eclipse Mosquitto | <=1.4.15 | |
Debian Debian Linux | =8.0 | |
Debian Debian Linux | =9.0 | |
ubuntu/mosquitto | <1.4.15-2ubuntu0.18.04.3 | 1.4.15-2ubuntu0.18.04.3 |
ubuntu/mosquitto | <1.4.15-2ubuntu0.18.10.3 | 1.4.15-2ubuntu0.18.10.3 |
ubuntu/mosquitto | <1.5.4-1 | 1.5.4-1 |
ubuntu/mosquitto | <1.4.8-1ubuntu0.16.04.7 | 1.4.8-1ubuntu0.16.04.7 |
debian/mosquitto | 2.0.11-1+deb11u1 2.0.11-1.2+deb12u1 2.0.18-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2017-7654 is a Memory Leak vulnerability found within the Mosquitto Broker in Eclipse Mosquitto 1.4.15 and earlier.
Unauthenticated clients can exploit the Memory Leak vulnerability in CVE-2017-7654 by sending crafted CONNECT packets, leading to a denial of service in the Mosquitto Broker.
CVE-2017-7654 has a severity rating of high, with a score of 7.5.
Eclipse Mosquitto versions 1.4.15 and earlier are affected by CVE-2017-7654.
To fix the Memory Leak vulnerability in CVE-2017-7654, update to the following versions: 1.4.15-2ubuntu0.18.04.3 (for Ubuntu Bionic), 1.4.15-2ubuntu0.18.10.3 (for Ubuntu Cosmic), 1.5.4-1 (for Ubuntu upstream), 1.4.8-1ubuntu0.16.04.7 (for Ubuntu Xenial), or 1.5.7-1+deb10u1, 2.0.11-1, 2.0.11-1+deb11u1, 2.0.11-1.2, 2.0.11-1.2+deb12u1, or 2.0.18-1 (for Debian).