The remote Ubuntu 20.04 ESM / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6492-1 advisory.

    Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an     automated system were provided with a specially crafted input, a remote attacker could possibly use this     issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)

    Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated     system were provided with a specially crafted input, a remote attacker could possibly use this issue to     cause an authorisation bypass. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04.
    (CVE-2021-34434)

    Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto incorrectly handled certain     inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2021-41039)

    Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system     were provided with a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2023-0809)

    It was discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were     provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial     of service. (CVE-2023-3592)

    Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated     system were provided with a specially crafted input, a remote attacker could possibly use this issue to     cause a denial of service. This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04.
    (CVE-2023-28366)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 20.04 ESM / 22.04 LTS / 23.04 : Mosquitto vulnerabilities (USN-6492-1)

critical Nessus Plugin ID 186038

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Sep 18, 2024, 8:52 AM CVSS metrics ("Cvssv4 threat vector" set to "CVSS:4.0/E:P") Plugin Feed: 202409180852
Version 1.1 Aug 28, 2024, 7:43 PM CVSS metrics ("Cvssv4 score" set to 9.3) CVSS metrics ("Cvssv4 vector" set to "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N") Detection (updated detection logic) Plugin metadata Plugin Feed: 202408281943
Version 1.0 Nov 21, 2023, 6:18 PM New Plugin Feed: 202311211818