CVE-2019-11778 Use after free in Eclipse Mosquitto

What is CVE-2019-11778?

CVE-2019-11778 is a medium-severity use after free vulnerability in The Eclipse Foundation Eclipse Mosquitto, published on 18 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations.

Weakness: CWE-416

Which versions are affected by CVE-2019-11778?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2019-11778?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2019-11778 being exploited?

There is no known exploitation of CVE-2019-11778 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Mosquitto

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-11778, GHSA-rr62-j9x2-468p.