CVE-2018-12551
First published: Wed Mar 27 2019(Updated: )
When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.
Credit: emo@eclipse.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eclipse Mosquitto | >=1.0<=1.5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-12551?
CVE-2018-12551 is a vulnerability in Eclipse Mosquitto versions 1.0 to 1.5.5 (inclusive) where malformed data in the password file can be treated as valid, allowing clients to circumvent authentication.
What is the severity of CVE-2018-12551?
The severity of CVE-2018-12551 is rated as high with a CVSS score of 8.1.
How does CVE-2018-12551 affect Eclipse Mosquitto?
CVE-2018-12551 affects Eclipse Mosquitto versions 1.0 to 1.5.5 (inclusive) when configured to use a password file for authentication.
How can clients exploit CVE-2018-12551?
Clients can exploit CVE-2018-12551 by providing malformed data in the password file, which will be treated as valid and allow them to bypass authentication.
Are there any references for CVE-2018-12551?
Yes, here are some references for CVE-2018-12551: - [CVE-2018-12551 on Eclipse Bugzilla](https://bugs.eclipse.org/bugs/show_bug.cgi?id=543401) - [CVE-2018-12551 on Debian LTS](https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html)
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/eclipse
- canonical/eclipse mosquitto
- version/eclipse mosquitto/1.0
- version/eclipse mosquitto/1.5.5