Log in Start free

Vulnerability · Published Oct 30, 2024 · Assigned by eclipse

CVE-2024-10525Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback

High 7.2

In plain English

A high-severity heap buffer overflow in mosquitto from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 59.2% (higher than 99.1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High
Exploit odds (30 days)59.2%top 0.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mosquitto2.0.11-1.2+deb12u2DEBIAN-CVE-2024-10525
Debian:13mosquitto2.0.20-1DEBIAN-CVE-2024-10525
Debian:14mosquitto2.0.20-1DEBIAN-CVE-2024-10525
Ubuntu:22.04:LTSmosquitto2.0.11-1ubuntu1.2USN-7441-1
Ubuntu:22.04:LTSmosquitto2.0.11-1ubuntu1.2UBUNTU-CVE-2024-10525

Affected products (as reported)

VendorProductVersions
Eclipse Foundation mosquitto 1.3.2 – through 2.0.18

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

References