Roger A. Light

5 exploits Active since Dec 2018
CVE-2018-20145 WRITEUP HIGH WRITEUP
Eclipse Mosquitto <1.5.5 - Auth Bypass
Eclipse Mosquitto 1.5.x before 1.5.5 allows ACL bypass: if the option per_listener_settings was set to true, and the default listener was in use, and the default listener specified an acl_file, then the acl file was being ignored.
CVSS 7.5
CVE-2023-28366 WRITEUP HIGH WRITEUP
Eclipse Mosquitto 1.3.2-2.0.15 - Memory Leak via QoS 2 Message Handling
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
CVSS 7.5
CVE-2024-10525 WRITEUP CRITICAL WRITEUP
Eclipse Mosquitto 1.3.2-2.0.18 - Heap-based Buffer Overflow via Crafted SUBACK Packet
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
CVSS 9.8
CVE-2024-3935 WRITEUP MEDIUM WRITEUP
Eclipse Mosquitto 2.0.0-2.0.18 - Double Free via Crafted PUBLISH Packet in Bridge Connection
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
CVSS 6.5
CVE-2024-8376 WRITEUP HIGH WRITEUP
Eclipse Mosquitto <2.0.18a - Use After Free
In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.
CVSS 7.5