CVE-2018-12551

Description

When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use a password file for authentication, any malformed data in the password file will be treated as valid. This typically means that the malformed data becomes a username and no password. If this occurs, clients can circumvent authentication and get access to the broker by using the malformed username. In particular, a blank line will be treated as a valid empty username. Other security measures are unaffected. Users who have only used the mosquitto_passwd utility to create and modify their password files are unaffected by this vulnerability.

How to fix CVE-2018-12551

To remediate CVE-2018-12551, upgrade the affected package to a fixed version below.

• —upgrade to 1.5.6-r0 or later
• —upgrade to 1.5.6-1 or later

Is CVE-2018-12551 being exploited?

Low — EPSS is 0.6%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 1.5.6-r0
• from 0, < 1.5.6-1

CVSS scores

References (2)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-12551
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2018-12551