Bug 549934 (CVE-2019-11777) - Request for CVE in known hostname validation vulnerability in the MQTT library
Summary: Request for CVE in known hostname validation vulnerability in the MQTT library
Status: VERIFIED FIXED
Alias: CVE-2019-11777
Product: Paho
Classification: IoT
Component: MQTT (show other bugs)
Version: unspecified   Edit
Hardware: Other Android
: P3 minor (vote)
Target Milestone: 1.2   Edit
Assignee: Ian Craggs CLA
QA Contact:
URL: https://cve.mitre.org/cgi-bin/cvename...
Whiteboard:
Keywords: security
Depends on:
Blocks:
 
Reported: 2019-08-09 10:09 EDT by Carolina Adaros CLA
Modified: 2019-09-17 16:30 EDT (History)
4 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Carolina Adaros CLA 2019-08-09 10:09:40 EDT 
Hello,

I am a member of the Bosch PSIRT and I am writing to you because a vulnerability was found by developers of an Android application related to one of our products which is related to a known hostname validation vulnerability in the MQTT library.

The fix for the Bosch app is already under development and a security update will be released soon, but we found out that the vulnerability in the MQTT library, despite beinn known, does not have an associated CVE: https://github.com/eclipse/paho.mqtt.java/issues/506

Therefore, we kindly request that you generate a CVE in order to document this vulnerability for future development. We understand that this vulnerability has been fixed in the latest version of the library. However, according to our developers, they need to use an older version because the current one does not support Android 7.

Please do not hesitate to contact me if you need more details about this, I will be happy to clarify any question with the development team. The overall aim is to do a responsible disclosure of both, the vulnerability and the fix so it is taken in account for future projects.

Kind Regards 
Carolina Adaros
Bosch PSIRT
Comment 1 Ian Craggs CLA 2019-09-04 11:46:12 EDT 
Thanks for submitting I will get one created.
Comment 2 Ian Craggs CLA 2019-09-06 10:09:50 EDT 
Hi Carolina.  Can you tell me exactly which version of the Paho library you do need to use, and why the latest version (1.2.1) does not work on Android 7?  Thanks.
Comment 3 Ian Craggs CLA 2019-09-06 10:37:25 EDT 
project: Eclipse Paho - Java client library

version: [1.2.0]

cwe: CWE-346: Origin Validation Error

summary: In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked.  This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Comment 4 Ian Craggs CLA 2019-09-11 05:49:20 EDT 
Fixed in version 1.2.1
Comment 5 Wayne Beaton CLA 2019-09-11 09:44:26 EDT 
We'll assign CVE-2019-11777
Comment 6 Wayne Beaton CLA 2019-09-11 09:52:40 EDT 
Pull request: https://github.com/CVEProject/cvelist/pull/2537
Comment 7 Ian Craggs CLA 2019-09-17 16:30:19 EDT 
Thanks Wayne.

https://nvd.nist.gov/vuln/detail/CVE-2019-11777