CVE-2017-7653

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that...

Original description

The description as published by the source.

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2017-7653 mosquitto Fixed in: 1.5.4-1

References

advisory docs.oasis-open.org
advisory lists.debian.org
advisory debian.org
report bugs.eclipse.org
web usn.ubuntu.com