CVE-2019-11779
19.09.2019, 14:15
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.Enginsight
| Vendor | Product | Version |
|---|---|---|
| eclipse | mosquitto | 1.5 ≤ 𝑥 < 1.5.9 |
| eclipse | mosquitto | 1.6 ≤ 𝑥 < 1.6.6 |
| canonical | ubuntu_linux | 19.04 |
| opensuse | backports_sle | 15.0:sp1 |
| opensuse | leap | 15.1 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-754 - Improper Check for Unusual or Exceptional ConditionsThe software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
- CWE-674 - Uncontrolled RecursionThe product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
References