Vulnerability · Published Aug 9, 2023 · Assigned by AHA
CVE-2023-2905Cesanta Mongoose MQTT Message Parsing Heap Overflow
High 8.8
In plain English
A high-severity heap buffer overflow in Mongoose from Cesanta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)1.0%top 36.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | swupdate | no fix listed | DEBIAN-CVE-2023-2905 |
| Debian:13 | swupdate | 2024.12+dfsg-1 | DEBIAN-CVE-2023-2905 |
| Debian:14 | swupdate | 2024.12+dfsg-1 | DEBIAN-CVE-2023-2905 |
| Ubuntu:22.04:LTS | swupdate | no fix listed | UBUNTU-CVE-2023-2905 |
| Ubuntu:24.04:LTS | swupdate | no fix listed | UBUNTU-CVE-2023-2905 |
Affected products (as reported)
Weakness: CWE-122
References
- https://takeonme.org/cves/CVE-2023-2905.html third-party-advisory, technical-description, exploit
- https://github.com/cesanta/mongoose/pull/2274 patch
- https://github.com/cesanta/mongoose/releases/tag/7.11 release-notes