CVE-2021-34431

Description

In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.37

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-34431 are affected in Mosquitto 2.0.10	Windows
Multiple Vulnerabilities are affected in IBM App Connect Enterprise 12.0.8.0	Windows
Multiple Vulnerabilities are affected in IBM App Connect Enterprise 11.0.0.20	Windows
MQTT version 3.1/3.1.1 compatible message broker (USN-6492-1) mosquitto_2.0.11-1ubuntu1.1_amd64.deb	Linux
MQTT version 3.1/3.1.1 compatible message broker (USN-6492-1) mosquitto_2.0.11-1.2ubuntu0.1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234