CVE-2017-7653
libmosquitto1: The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8
CVE-2017-7653 is fixed in 4 products on 1 platform, first by libmosquitto1 1.4.15-2ubuntu0.18.04.3, released June 4, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0144
73rd percentile
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libmosquitto1 · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.3 | libmosquitto1 1.4.15-2ubuntu0.18.04.3 | Jun 4, 2018 |
| libmosquittopp1 · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.3 | libmosquittopp1 1.4.15-2ubuntu0.18.04.3 | Jun 4, 2018 |
| mosquitto · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.3 | mosquitto 1.4.15-2ubuntu0.18.04.3 | Jun 4, 2018 |
| mosquitto-clients · Ubuntu 18.04.6 LTS (bionic) | 1.4.15-2ubuntu0.18.04.3 | mosquitto-clients 1.4.15-2ubuntu0.18.04.3 | Jun 4, 2018 |