CVE-2018-12543: Input Validation
Published Nov 15, 2018
·Updated
In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit.
Affected Software
1 affected component
Eclipse Mosquitto>=1.5.0<=1.5.2
Event History
Nov 15, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2018-12543.
2
What is the severity of CVE-2018-12543?
The severity of CVE-2018-12543 is high.
3
Which software versions are affected by CVE-2018-12543?
Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive are affected by CVE-2018-12543.
4
How does CVE-2018-12543 exploit work?
If a message is published to Mosquitto with a topic starting with $, but not $SYS, an assert is triggered that should not be reachable, causing Mosquitto to exit.
5
Is there a reference for more information on CVE-2018-12543?
Yes, you can find more information on CVE-2018-12543 at https://bugs.eclipse.org/bugs/show_bug.cgi?id=539295.