Bug 2244840 (CVE-2023-5632)

Summary:	CVE-2023-5632 Mosquitto: Possible Denial of Service due to excessive CPE consumption
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aileenc, bbuckingham, bcourt, chazlett, cmiranda, ehelms, fmariani, gmalinko, janstey, jpoth, jsherril, lzap, mhulan, nmoumoul, orabin, pcongius, pcreech, peholase, pjindal, rchan, tcunning, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mosquitto 2.0.6	Doc Type:	If docs needed, set a value
Doc Text:	A denial of service vulnerability was found in Eclipse Mosquitto. Establishing a connection to the Mosquitto server without sending data could lead to excessive CPU consumption and a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2244841
Bug Blocks:	2244839

Description Marco Benatto 2023-10-18 13:50:45 UTC

In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6

https://github.com/eclipse/mosquitto/pull/2053
https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d