CVE-2023-28366

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28366
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9 Patch
https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16 Release Notes
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X/
https://mosquitto.org/blog/2023/08/version-2-0-16-released/ Release Notes
https://security.gentoo.org/glsa/202401-09
https://www.compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt Third Party Advisory
https://www.debian.org/security/2023/dsa-5511
Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*
History

07 Jan 2024, 10:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-09 -

07 Nov 2023, 04:10

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X/', 'name': 'FEDORA-2023-9adc4be8b0', 'tags': [], 'refsource': 'FEDORA'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X/ -

02 Oct 2023, 12:15

Type Values Removed Values Added
References
  • (DEBIAN) https://www.debian.org/security/2023/dsa-5511 -

15 Sep 2023, 21:15

Type Values Removed Values Added
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X/ -

07 Sep 2023, 18:29

Type Values Removed Values Added
References (CONFIRM) https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9 - (CONFIRM) https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9 - Patch
References (MISC) https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16 - (MISC) https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16 - Release Notes
References (CONFIRM) https://mosquitto.org/blog/2023/08/version-2-0-16-released/ - (CONFIRM) https://mosquitto.org/blog/2023/08/version-2-0-16-released/ - Release Notes
References (MISC) https://www.compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt - (MISC) https://www.compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt - Third Party Advisory
CPE cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*
CWE CWE-401
First Time Eclipse
Eclipse mosquitto
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

01 Sep 2023, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-09-01 16:15

Updated : 2024-01-07 10:15

NVD link : CVE-2023-28366

Mitre link : CVE-2023-28366

CVE.ORG link : CVE-2023-28366

JSON object : View

Products Affected

eclipse

  • mosquitto
CWE
CWE-401

Missing Release of Memory after Effective Lifetime