CVE-2018-12546: Medium severity tibco messaging - eclipse mosquitto distribution - core vulnerability
In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-12546?
The severity of CVE-2018-12546 is medium with a CVSS score of 6.5.
What is the description of CVE-2018-12546?
CVE-2018-12546 is a vulnerability in Eclipse Mosquitto version 1.0 to 1.5.5 that allows retained messages to be published to unauthorized clients.
How does CVE-2018-12546 affect Eclipse Mosquitto?
CVE-2018-12546 affects Eclipse Mosquitto versions 1.0 to 1.5.5 by allowing unauthorized clients to receive retained messages after access to the topic has been revoked.
Is there a fix for CVE-2018-12546?
Yes, upgrading to a version above 1.5.5 or applying the relevant patch addresses the CVE-2018-12546 vulnerability.
Where can I find more information about CVE-2018-12546?
More information about CVE-2018-12546 can be found at the following link: https://bugs.eclipse.org/bugs/show_bug.cgi?id=543127