ByteOS Network

NVD Vulnerability Details :

CVE-2024-3935

Analyzed

Source-emo@eclipse.org

Published At-30 Oct, 2024 | 12:15

Updated At-29 Jan, 2025 | 17:12

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	6.0	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CPE Matches

Eclipse Foundation AISBL

>>mosquitto>>Versions from 2.0.0(inclusive) to 2.0.19(exclusive)

cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-415	Secondary	emo@eclipse.org
CWE-415	Primary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9	emo@eclipse.org	Patch
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197	emo@eclipse.org	Exploit Issue Tracking Vendor Advisory
https://mosquitto.org/blog/2024/10/version-2-0-19-released/	emo@eclipse.org	Release Notes

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History