Your submission was sent successfully! Close

CVE-2017-7652

Published: 25 April 2018

In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.

From the Ubuntu security team

It was discovered that Mosquitto incorrectly handled file descriptors. An attacker could possibly use this issue to cause a denial of service.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
mosquitto
Launchpad, Ubuntu, Debian
Upstream
Released (1.4.15-1)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(1.4.15-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1.4.8-1ubuntu0.16.04.4)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (0.15-2+deb7u3ubuntu0.1)