CVE-2019-11779 Denial of service in Eclipse Mosquitto
A malicious MQTT client can cause a stack overflow and denial of service in Eclipse Mosquitto by sending a subscribe packet with excessive topic separators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11779?
CVE-2019-11779 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 19 Sep 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.
Which versions are affected by CVE-2019-11779?
It affects 6 products.
Linux distribution packages (2)
mosquitto SUSE:Package Hub 15 SP1 | All versions | 1.5.7-bp151.3.3.1 |
mosquitto openSUSE:Leap 15.1 | All versions | 1.5.7-lp151.2.3.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Eclipse Mosquitto, Fedoraproject Fedora, Opensuse Backports Sle, Opensuse Leap.
How do I fix CVE-2019-11779?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11779 being exploited?
There is no known exploitation of CVE-2019-11779 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2019-11779, DEBIAN-CVE-2019-11779, DSA-4570-1, GHSA-wjwr-9f4q-q8h8, MGASA-2019-0345, openSUSE-SU-2019:2206-1 and 1 more.