CVE-2024-8376

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-8376
In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216 Issue Tracking
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217 Issue Tracking
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218 Issue Tracking
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227 Issue Tracking
https://gitlab.eclipse.org/security/cve-assignement/-/issues/26 Issue Tracking
https://github.com/eclipse/mosquitto/releases/tag/v2.0.19 Patch Product
https://mosquitto.org/ Product
https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*
History

15 Nov 2024, 17:21

Type Values Removed Values Added
CPE cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*
First Time Eclipse mosquitto
Eclipse
References () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217 - () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/217 - Issue Tracking
References () https://github.com/eclipse/mosquitto/releases/tag/v2.0.19 - () https://github.com/eclipse/mosquitto/releases/tag/v2.0.19 - Patch, Product
References () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227 - () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/227 - Issue Tracking
References () https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 - () https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 - Patch
References () https://mosquitto.org/ - () https://mosquitto.org/ - Product
References () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218 - () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/218 - Issue Tracking
References () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216 - () https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/216 - Issue Tracking
References () https://gitlab.eclipse.org/security/cve-assignement/-/issues/26 - () https://gitlab.eclipse.org/security/cve-assignement/-/issues/26 - Issue Tracking
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CWE CWE-401
CWE-416
CWE-755

31 Oct 2024, 10:15

Type Values Removed Values Added
References
  • () https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 -

11 Oct 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-11 16:15

Updated : 2024-11-15 17:21

NVD link : CVE-2024-8376

Mitre link : CVE-2024-8376

JSON object : View

Products Affected

eclipse

  • mosquitto
CWE
CWE-755

Improper Handling of Exceptional Conditions

CWE-401

Missing Release of Memory after Effective Lifetime

CWE-416

Use After Free