Description
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The Eclipse Foundation Eclipse Mosquitto
1.4.14affected
References
- https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html ↗
- https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ ↗
- https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html ↗
- https://www.debian.org/security/2018/dsa-4325 ↗
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=529754 ↗