The Eclipse Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with Eclipse Hono.
Products
Clear product- Eclipse Jetty23 vulnerabilities
- Eclipse Mosquitto16 vulnerabilities
- Eclipse OpenJ914 vulnerabilities
- Eclipse Theia6 vulnerabilities
- Eclipse Vert.x6 vulnerabilities
- Eclipse Californium3 vulnerabilities
- Eclipse Kura3 vulnerabilities
- Eclipse OMR3 vulnerabilities
- Eclipse BIRT2 vulnerabilities
- Eclipse Che2 vulnerabilities
- Eclipse Hawkbit2 vulnerabilities
- Eclipse Hono2 vulnerabilities
- Eclipse Memory Analyzer2 vulnerabilities
- @theia/plugin-ext1 vulnerability
- Eclipse BIRT (Business Intelligence Reporting Tool)1 vulnerability
- Eclipse Buildship1 vulnerability
- Eclipse Equinox1 vulnerability
- Eclipse Equinox p21 vulnerability
- Eclipse GlassFish1 vulnerability
- Eclipse Jersey1 vulnerability
- Eclipse Lyo1 vulnerability
- Eclipse Paho1 vulnerability
- Eclipse Paho MQTT C Client1 vulnerability
- Eclipse Platform1 vulnerability
- Eclipse Sphinx1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-27220HIGH | The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & con… CWE-862Jan 14, 2021 | CVSS8.8v3.1 | EPSS1.15% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-27217HIGH | Improper Validation of Specified Quantity in Input in Eclipse HonoIn Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing … CWE-1284Nov 13, 2020 | CVSS7.5v3.1 | EPSS1.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |