QwikSec

Security Database

CVE

CWE

Training

CVE-2017-7652

Published: Apr 25, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Mosquitto	affected `1.4.14`

Weaknesses (CWE)

References

[debian-lts-announce] 20180331 [SECURITY] [DLA 1334-1] mosquitto security update

mailing-list

x_refsource_MLIST

https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/

x_refsource_CONFIRM

[debian-lts-announce] 20180629 [SECURITY] [DLA 1409-1] mosquitto security update

mailing-list

x_refsource_MLIST

https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102

x_refsource_CONFIRM

vendor-advisory

x_refsource_DEBIAN

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.