CVE-2023-34488: High severity emqx Nanomq vulnerability
NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the connhandler function of mqttparser.c when it processes malformed messages.
Other sources
NanoMQ 0.17.5 is vulnerable to heap-buffer-overflow in the connhandler function of mqttparser.c when it processes malformed messages.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-34488?
CVE-2023-34488 is classified as a critical vulnerability due to the potential for heap buffer overflow that can lead to arbitrary code execution.
How do I fix CVE-2023-34488?
To mitigate CVE-2023-34488, upgrade NanoMQ to version 0.17.6 or later, which addresses the heap-buffer-overflow vulnerability.
What is the impact of CVE-2023-34488 on NanoMQ?
CVE-2023-34488 allows attackers to exploit malformed MQTT messages, potentially crashing the service or executing unauthorized commands.
Which versions of NanoMQ are affected by CVE-2023-34488?
CVE-2023-34488 affects NanoMQ version 0.17.5 and earlier versions.
How can I determine if my system is vulnerable to CVE-2023-34488?
You can check your system for the presence of NanoMQ version 0.17.5 to determine if it is vulnerable to CVE-2023-34488.