Homepage

Improper Authentication Affecting mosquitto package, versions <1.4.15-2ubuntu0.18.10.1

Severity

 Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
1.48% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1810-MOSQUITTO-336615
  • published9 Feb 2019
  • disclosed27 Mar 2019
Report a new vulnerability Found a mistake?

Introduced: 9 Feb 2019

CVE-2018-12551  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade Ubuntu:18.10 mosquitto to version 1.4.15-2ubuntu0.18.10.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mosquitto package and not the mosquitto package as distributed by Ubuntu. See How to fix? for Ubuntu:18.10 relevant fixed versions and status.

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.