CVE-2023-2905
Cesanta Mongoose MQTT Message Parsing Heap Overflow
Summary
Cesanta Mongoose MQTT Message Parsing Heap Overflow
Original description
The description as published by the source.
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-2905 swupdate
- Ubuntu UBUNTU-CVE-2023-2905 swupdate
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report takeonme.org