CVE-2024-8376

Summary

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

Affected Software

Weaknesses

• CWE-401: CWE-401 Missing Release of Memory after Effective Lifetime
• CWE-416: CWE-416 Use After Free
• CWE-755: CWE-755 Improper Handling of Exceptional Conditions

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/26
• https://github.com/eclipse/mosquitto/releases/tag/v2.0.19
• https://mosquitto.org/
• https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17

• ←Previous
• Next→