Bug 2236882 (CVE-2023-0809, CVE-2023-28366, CVE-2023-3592) - CVE-2023-0809 CVE-2023-28366 CVE-2023-3592 mosquitto: memory leak leads to unresponsive broker
Summary: CVE-2023-0809 CVE-2023-28366 CVE-2023-3592 mosquitto: memory leak leads to un...
Keywords:
Status: NEW
Alias: CVE-2023-0809, CVE-2023-28366, CVE-2023-3592
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2236883 2257305
Blocks: 2236880
TreeView+ depends on / blocked
 
Reported: 2023-09-01 20:54 UTC by Chess Hazlett
Modified: 2024-04-30 23:00 UTC (History)
22 users (show)

Fixed In Version: mosquitto 2.0.16
Doc Type: If docs needed, set a value
Doc Text:
A memory leak vulnerability was found in Eclipse Mosquitto. This issue is triggered by malicious initial packets or certain client actions and may allow a remote attacker to the deplete system resources causing memory exhaustion, leading to a disruption in services and a denial of service condition.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2024:0797 0 None None None 2024-02-13 14:42:51 UTC
Red Hat Product Errata RHSA-2024:1061 0 None None None 2024-02-29 20:35:00 UTC

Description Chess Hazlett 2023-09-01 20:54:20 UTC 
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Comment 4 errata-xmlrpc 2024-02-13 14:42:49 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.14 for RHEL 8

Via RHSA-2024:0797 https://access.redhat.com/errata/RHSA-2024:0797
Comment 6 errata-xmlrpc 2024-02-29 20:34:58 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.13 for RHEL 8

Via RHSA-2024:1061 https://access.redhat.com/errata/RHSA-2024:1061
Note You need to log in before you can comment on or make changes to this bug.