CVE-2024-3935

CVSS V2 None CVSS V3 None

Description

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

Overview

CVE ID
CVE-2024-3935

Assigner
eclipse

Vulnerability Status
PUBLISHED

Published Version
2024-10-30T11:45:23.506Z

Last Modified Date
2024-10-30T13:32:22.999Z

Weakness Enumerations

CWE	URL
CWE-415	http://cwe.mitre.org/data/definitions/415.html

References

Reference URL	Reference Tags
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197
https://mosquitto.org/blog/2024/10/version-2-0-19-released/

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-3935
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3935

History

Created	Old Value	New Value	Data Type	Notes
2024-10-31 13:08:58				Added to TrackCVE