In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service.

The remote Ubuntu 20.04 ESM / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6492-1 advisory.

    Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an     automated system were provided with a specially crafted input, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)

    Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated     system were provided with a specially crafted input, a remote attacker could possibly use this issue to     cause an authorisation bypass. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04.
    (CVE-2021-34434)

    Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto incorrectly handled certain     inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2021-41039)

    Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system     were provided with a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2023-0809)

    It was discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were     provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial     of service. (CVE-2023-3592)

    Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated     system were provided with a specially crafted input, a remote attacker could possibly use this issue to     cause a denial of service. This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04.
    (CVE-2023-28366)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5511 advisory.

    Several security vulnerabilities have been discovered in mosquitto, a MQTT compatible message broker,     which may be abused for a denial of service attack. CVE-2021-34434 In Eclipse Mosquitto when using the     dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a     durable client is offline, then existing subscriptions for that client are not revoked. CVE-2023-0809 Fix     excessive memory being allocated based on malicious initial packets that are not CONNECT packets.
    CVE-2023-3592 Fix memory leak when clients send v5 CONNECT packets with a will message that contains     invalid property types. CVE-2023-28366 The broker in Eclipse Mosquitto has a memory leak that can be     abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond     to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. Additionally     CVE-2021-41039 has been fixed for Debian 11 Bullseye. CVE-2021-41039 An MQTT v5 client connecting with a     large number of user-property properties could cause excessive CPU usage, leading to a loss of performance     and possible denial of service. For the oldstable distribution (bullseye), these problems have been fixed     in version 2.0.11-1+deb11u1. For the stable distribution (bookworm), these problems have been fixed in     version 2.0.11-1.2+deb12u1. We recommend that you upgrade your mosquitto packages. For the detailed     security status of mosquitto please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/mosquitto

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
186038	Ubuntu 20.04 ESM / 22.04 LTS / 23.04 : Mosquitto vulnerabilities (USN-6492-1)	Nessus	Ubuntu Local Security Checks	medium
182418	Debian DSA-5511-1 : mosquitto - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2021-41039

high

Tenable Plugins

medium

critical