CVE-2024-10525: Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its onsubscribe callback. This affects the mosquittosub and mosquittorr clients.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10525?
CVE-2024-10525 is considered a medium severity vulnerability due to the potential for out-of-bounds memory access.
How do I fix CVE-2024-10525?
To fix CVE-2024-10525, upgrade Eclipse Mosquitto to version 2.0.19 or later.
What versions of Eclipse Mosquitto are affected by CVE-2024-10525?
CVE-2024-10525 affects Eclipse Mosquitto versions from 1.3.2 through 2.0.18.
What type of attack does CVE-2024-10525 enable?
CVE-2024-10525 allows an attacker to exploit a malicious broker's crafted SUBACK packet to cause a client to make out-of-bounds memory access.
Is the eclipse mosquitto_sub client impacted by CVE-2024-10525?
Yes, the mosquitto_sub client using libmosquitto is impacted by CVE-2024-10525.