CVE-2019-5432 Improper Input Validation and Buffer Over-read in mqtt-packet
A malformed MQTT Subscribe packet crashes MQTT brokers using the mqtt-packet library, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5432?
CVE-2019-5432 is a high-severity denial of service vulnerability in mqtt-packet, published on 6 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
Which versions are affected by CVE-2019-5432?
8 open source packages ship an affected version, including mqtt-packet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mqtt-packet npm | All versions | 3.5.1 |
mqtt-packet npm | All versions | 3.5.1 |
mqtt-packet npm | From 4.0.0 | 4.1.3 |
mqtt-packet npm | From 4.0.0 | 4.1.3 |
mqtt-packet npm | From 5.0.0 | 5.6.1 |
mqtt-packet npm | From 5.0.0 | 5.6.1 |
2 more packages
mqtt-packet npm | From 6.0.0 | 6.1.2 |
mqtt-packet npm | From 6.0.0 | 6.1.2 |
Products include Mqtt-Packet Project Mqtt-Packet.
How do I fix CVE-2019-5432?
Upgrade mqtt-packet to a fixed version for your release line: 3.5.1, 4.1.3, 5.6.1 or 6.1.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-5432 being exploited?
There is no known exploitation of CVE-2019-5432 in the wild and no public exploit code.
Other vulnerabilities in mqtt-packet
Sources
Also known as DEBIAN-CVE-2019-5432, GHSA-wv67-9jq7-8r69, UBUNTU-CVE-2019-5432.