CVE-2017-7652

In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
eclipseCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
VendorProductVersion
eclipsemosquitto
1.0 ≤
𝑥
≤ 1.4.14
debiandebian_linux
7.0
debiandebian_linux
8.0
debiandebian_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mosquitto
bullseye (security)
2.0.11-1+deb11u1
fixed
bullseye
2.0.11-1+deb11u1
fixed
bookworm
2.0.11-1.2+deb12u1
fixed
bookworm (security)
2.0.11-1.2+deb12u1
fixed
sid
2.0.20-1
fixed
trixie
2.0.20-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mosquitto
bionic
not-affected
artful
ignored
xenial
Fixed 1.4.8-1ubuntu0.16.04.4
released
trusty
Fixed 0.15-2+deb7u3ubuntu0.1
released
Common Weakness Enumeration
References
https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102
https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html
https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html
https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/
https://www.debian.org/security/2018/dsa-4325
https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102
https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html
https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html
https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/
https://www.debian.org/security/2018/dsa-4325