In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

The version of IBM WebSphere Application Server Liberty running on the remote host is affected by a vulnerability as referenced in the 6602039 advisory.

  - In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and     setting a host name verifier, the result of that verification is not checked. This could allow one MQTT     server to impersonate another and provide the client library with incorrect information. (CVE-2019-11777)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

CVE-2019-11777

high

Tenable Plugins

high