CVE Vulnerabilities

CVE-2017-7652

Published: Apr 25, 2018 | Modified: Oct 09, 2019
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.

Affected Software

Name Vendor Start Version End Version
Mosquitto Eclipse 1.0 (including) 1.4.14 (including)
Mosquitto Ubuntu artful *
Mosquitto Ubuntu trusty *
Mosquitto Ubuntu upstream *
Mosquitto Ubuntu xenial *

References