CVE-2018-12551 Auth bypass in Eclipse Mosquitto

What is CVE-2018-12551?

CVE-2018-12551 is a high-severity authentication bypass vulnerability in The Eclipse Foundation Eclipse Mosquitto, published on 27 Mar 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.

Weakness: CWE-287, CWE-703

Which versions are affected by CVE-2018-12551?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2018-12551?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-12551 being exploited?

There is no known exploitation of CVE-2018-12551 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Mosquitto

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5
• CVE-2021-34432 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2018-12551, DEBIAN-CVE-2018-12551, GHSA-5hh6-jrm5-mqxq, UBUNTU-CVE-2018-12551.