Bug 572608 (CVE-2021-28166) - Mosquitto: CVE request - NULL pointer dereference on crafted CONNACK
Summary: Mosquitto: CVE request - NULL pointer dereference on crafted CONNACK
Status: RESOLVED FIXED
Alias: CVE-2021-28166
Product: Community
Classification: Eclipse Foundation
Component: Vulnerability Reports (show other bugs)
Version: unspecified   Edit
Hardware: PC Linux
: P3 critical (vote)
Target Milestone: ---   Edit
Assignee: Security vulnerabilitied reported against Eclipse projects CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on:
Blocks:
 
Reported: 2021-04-06 05:06 EDT by Roger Light CLA
Modified: 2021-08-05 11:11 EDT (History)
3 users (show)

See Also:

Attachments
Patch for Mosquitto versions 2.0.0-2.0.9. (3.61 KB, patch)
2021-04-06 05:06 EDT, Roger Light CLA 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Roger Light CLA 2021-04-06 05:06:11 EDT 
Created attachment 286040 [details]
Patch for Mosquitto versions 2.0.0-2.0.9.

I'd like to request a CVE be assigned for Mosquitto. Unfortunately the vulnerability was reported in public. It has already been fixed in version 2.0.10. A patch for 2.0.0-2.0.9 is attached.

project: Eclipse Mosquitto
version: [2.0.0, 2.0.9]

cwe: CWE-476: NULL Pointer Dereference

summary: In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.

CVSS score: 6.0

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C&version=3.1
Comment 1 Wayne Beaton CLA 2021-04-07 14:47:48 EDT 
We'll use CVE-2021-28166

I've pushed the report to the central authority.

https://github.com/CVEProject/cvelist/pull/1254
Comment 2 Wayne Beaton CLA 2021-07-29 10:43:39 EDT 
Roger, I believe that you're referencing this issue in the change log [1], but using the wrong CVE (CVE-2021-23980). Can you confirm/fix?

[1] https://github.com/eclipse/mosquitto/blob/master/ChangeLog.txt
Comment 3 Roger Light CLA 2021-08-05 11:11:09 EDT 
Thanks Wayne, that is now fixed.