CVE-2023-33658: Buffer Overflow

Published Jun 8, 2023

Updated

A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nnimsggetpubpid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.

Affected Software

1 affected component

emqx Nanomq=0.17.2

Remediation

Patch Available

https://github.com/nanomq/NanoNNG/commit/657e6c81c474bdee0e6413483b990e90610030c1

Event History

Jun 8, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2023-33658?

CVE-2023-33658 is classified as a high severity vulnerability due to the potential for denial of service attacks.

How do I fix CVE-2023-33658?

To mitigate CVE-2023-33658, upgrade NanoMQ to version 0.17.3 or later where this vulnerability is addressed.

What software is affected by CVE-2023-33658?

CVE-2023-33658 specifically affects NanoMQ version 0.17.2.

How can CVE-2023-33658 be exploited?

CVE-2023-33658 can be exploited by an attacker calling the function nni_msg_get_pub_pid(), leading to a heap buffer overflow.

What is the potential impact of CVE-2023-33658?

The potential impact of CVE-2023-33658 includes causing a denial of service condition for systems running the affected software.