Detections
Analytics
Alpine: multiple mosquitto packages: security update to 1.4.15-r0
high Tenable Self-Hosted Container Security Plugin ID 424199
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory
with a lot of connections with large payload. This can be done without authentications if occur in
connection phase of MQTT protocol. (CVE-2017-7651)
- In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then
sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of
clients connected so that there are no more file descriptors/sockets available (default limit typically
1024 file descriptors on Linux), then opening the configuration file will fail. (CVE-2017-7652)
- In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local
users to obtain sensitive MQTT topic information. (CVE-2017-9868)
See Also
https://security.alpinelinux.org/vuln/CVE-2017-7651
Plugin Details
Severity: High
ID: 424199
Version: Revision 1.7
Type: Local
Published: 4/4/2025
Updated: 5/30/2025
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2017-7652
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/25/2017