CVE-2023-28366

概要

参考情報

• eclipse/mosquitto commit 6113eac · Patch
• eclipse/mosquitto · Release Notes
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X
• mosquitto.org/blog/2023/08/version-2-0-16-released · Release Notes
• security.gentoo.org/glsa/202401-09
• compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt · Third Party Advisory
• debian.org/security/2023/dsa-5511

mosquitto のその他の脆弱性

• CVE-2024-3935中 6.5In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and th…
• CVE-2024-10525緊急 9.8In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client …
• CVE-2024-8376高 7.5In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending spe…
• CVE-2023-5632高 7.5In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT e…
• CVE-2023-3592高 7.5In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property typ…