CVE-2019-11777: High severity Eclipse Paho Java client vulnerability
Eclipse Paho Java client could allow a remote attacker to bypass security restrictions, caused by the failure to check the result when connecting to an MQTT server using TLS and setting a host name verifier. By sending a specially-crafted request, an attacker could exploit this vulnerability to allow one MQTT server to impersonate another and provide the client library with incorrect information.
Other sources
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11777?
CVE-2019-11777 is considered a high severity vulnerability due to the possibility of server impersonation and incorrect information being provided to the client.
How do I fix CVE-2019-11777?
To fix CVE-2019-11777, upgrade the Eclipse Paho Java client library to version 1.2.1 or later.
What impact does CVE-2019-11777 have on security?
CVE-2019-11777 can lead to man-in-the-middle attacks where an attacker could impersonate an MQTT server.
Which version of Eclipse Paho Java Client is affected by CVE-2019-11777?
CVE-2019-11777 affects Eclipse Paho Java Client version 1.2.0.
Is CVE-2019-11777 part of a larger series of vulnerabilities?
CVE-2019-11777 is a standalone vulnerability affecting the specific version of the Eclipse Paho Java Client.