CVE-2024-8376

Published: Oct 11, 2024

Modified: Oct 31, 2024

PUBLISHED

Description

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

Vendor	Product	Versions
Eclipse Foundation	Mosquitto	affected `2.0.18` unaffected `2.0.19`

Weaknesses (CWE)

CWE-401

CWE-416

CWE-755

References

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216

issue-tracking

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217

issue-tracking

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218

issue-tracking

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227

issue-tracking

https://gitlab.eclipse.org/security/cve-assignement/-/issues/26

vendor-advisory

https://github.com/eclipse/mosquitto/releases/tag/v2.0.19

patch

https://mosquitto.org/

product

https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17

patch

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2024-8376

Description

Affected Products

Weaknesses (CWE)

References