QwikSec

Security Database

CVE

CWE

Training

CVE-2018-12550

Published: Mar 27, 2019

Modified: Aug 5, 2024

PUBLISHED

Description

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.

Vendor	Product	Versions
The Eclipse Foundation	Eclipse Mosquitto	affected `1.0 - < unspecified` affected `unspecified - <= 1.5.5`

Weaknesses (CWE)

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=541870

x_refsource_CONFIRM

[debian-lts-announce] 20191026 [SECURITY] [DLA 1972-1] mosquitto security update

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.