Description
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The Eclipse Foundation Eclipse Mosquitto
1.4.14affected
References
- https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html ↗
- https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/ ↗
- https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html ↗
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102 ↗
- https://www.debian.org/security/2018/dsa-4325 ↗