CVE-2017-7652
Publication date 25 April 2018
Last updated 24 July 2024
Ubuntu priority
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
From the Ubuntu Security Team
It was discovered that Mosquitto incorrectly handled file descriptors. An attacker could possibly use this issue to cause a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mosquitto | 18.04 LTS bionic |
Not affected
|
| 16.04 LTS xenial |
Fixed 1.4.8-1ubuntu0.16.04.4
|
|
| 14.04 LTS trusty |
Fixed 0.15-2+deb7u3ubuntu0.1
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
7.5 · High
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |