CVE-2023-0809
libmosquitto1: In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT pac...
CVE-2023-0809 is fixed in 4 products on 1 platform, first by libmosquitto1 1.6.9-1ubuntu0.1~esm1, released October 2, 2023. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.3
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0071
53rd percentile
In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libmosquitto1 · Ubuntu 20.04 LTS (focal) | 1.6.9-1ubuntu0.1~esm1 | libmosquitto1 1.6.9-1ubuntu0.1~esm1 | Oct 2, 2023 |
| libmosquitto1 · Ubuntu 22.04.1 LTS (jammy) | 2.0.11-1ubuntu1.1 | libmosquitto1 2.0.11-1ubuntu1.1 | Oct 2, 2023 |
| libmosquittopp1 · Ubuntu 20.04 LTS (focal) | 1.6.9-1ubuntu0.1~esm1 | libmosquittopp1 1.6.9-1ubuntu0.1~esm1 | Oct 2, 2023 |
| libmosquittopp1 · Ubuntu 22.04.1 LTS (jammy) | 2.0.11-1ubuntu1.1 | libmosquittopp1 2.0.11-1ubuntu1.1 | Oct 2, 2023 |
| mosquitto · Debian 12.15 (bookworm) | 2.0.11-1.2+deb12u1 | DEBIAN-CVE-2023-0809 | Oct 2, 2023 |
| mosquitto · Debian 13.5 (trixie) | 2.0.17-1 | DEBIAN-CVE-2023-0809 | Oct 2, 2023 |
| mosquitto · Debian 14 | 2.0.17-1 | DEBIAN-CVE-2023-0809 | Oct 2, 2023 |
| mosquitto · Ubuntu 20.04 LTS (focal) | 1.6.9-1ubuntu0.1~esm1 | mosquitto 1.6.9-1ubuntu0.1~esm1 | Oct 2, 2023 |
| mosquitto · Ubuntu 22.04.1 LTS (jammy) | 2.0.11-1ubuntu1.1 | mosquitto 2.0.11-1ubuntu1.1 | Oct 2, 2023 |
| mosquitto-clients · Ubuntu 20.04 LTS (focal) | 1.6.9-1ubuntu0.1~esm1 | mosquitto-clients 1.6.9-1ubuntu0.1~esm1 | Oct 2, 2023 |
| mosquitto-clients · Ubuntu 22.04.1 LTS (jammy) | 2.0.11-1ubuntu1.1 | mosquitto-clients 2.0.11-1ubuntu1.1 | Oct 2, 2023 |