CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Alpine Linux ALPINE-CVE-2023-28366 mosquitto Corrigé dans: 2.0.16-r0
Debian DEBIAN-CVE-2023-28366 mosquitto Corrigé dans: 2.0.11-1+deb11u1

Références

advisory github.com
advisory lists.fedoraproject.org
advisory nvd.nist.gov
advisory security.gentoo.org
advisory debian.org
patch github.com
web github.com
web compass-security.com
web mosquitto.org