CVE-2021-34434 Missing authorization in Eclipse Mosquitto

What is CVE-2021-34434?

CVE-2021-34434 is a medium-severity missing authorization vulnerability in Fedoraproject Fedora, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.

Weakness: CWE-863, CWE-285

Which versions are affected by CVE-2021-34434?

It affects 2 products.

Products include Eclipse Mosquitto, Fedoraproject Fedora.

How do I fix CVE-2021-34434?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-34434 being exploited?

There is no known exploitation of CVE-2021-34434 in the wild and no public exploit code.

Other vulnerabilities in Fedoraproject Fedora

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5

All Fedoraproject Fedora vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-34434, GHSA-cj6r-mprf-8cq9, MGASA-2021-0445, UBUNTU-CVE-2021-34434.