CVE-2023-28366
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2023-28366 mosquitto 修正版: 2.0.16-r0
- Debian DEBIAN-CVE-2023-28366 mosquitto 修正版: 2.0.11-1+deb11u1
参照URL
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory debian.org
- patch github.com
- web github.com
- web compass-security.com
- web mosquitto.org