The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5511 advisory.

    Several security vulnerabilities have been discovered in mosquitto, a MQTT compatible message broker,     which may be abused for a denial of service attack. CVE-2021-34434 In Eclipse Mosquitto when using the     dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a     durable client is offline, then existing subscriptions for that client are not revoked. CVE-2023-0809 Fix     excessive memory being allocated based on malicious initial packets that are not CONNECT packets.
    CVE-2023-3592 Fix memory leak when clients send v5 CONNECT packets with a will message that contains     invalid property types. CVE-2023-28366 The broker in Eclipse Mosquitto has a memory leak that can be     abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond     to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. Additionally     CVE-2021-41039 has been fixed for Debian 11 Bullseye. CVE-2021-41039 An MQTT v5 client connecting with a     large number of user-property properties could cause excessive CPU usage, leading to a loss of performance     and possible denial of service. For the oldstable distribution (bullseye), these problems have been fixed     in version 2.0.11-1+deb11u1. For the stable distribution (bookworm), these problems have been fixed in     version 2.0.11-1.2+deb12u1. We recommend that you upgrade your mosquitto packages. For the detailed     security status of mosquitto please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/mosquitto

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5511-1 : mosquitto - security update

critical Nessus Plugin ID 182418

Version 1.1

Version 1.0

Version 1.1 Jan 24, 2025, 9:25 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Plugin metadata Plugin Feed: 202501242125
Version 1.0 Oct 2, 2023, 4:16 PM New Plugin Feed: 202310021616