CVE-2017-7651: debian debian_linux
CVSS: 7.5v3.0HighModified
AliasesALPINE-CVE-2017-7651UBUNTU-CVE-2017-7651DEBIAN-CVE-2017-7651
Published 24-04-2018Last modified 05-08-2024
Vulnerability summary
CVE-2017-7651 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 5.12% chance of exploitation in the next 30 days, higher than 92.2% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.0 (NVD)EPSS score
5.12%
0%100%
Low · -0.10 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 24-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
5.12%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
-0.10 pp
From 5.21% on 18-09-2026
18-09-202618-10-2026
EPSS score5.12%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Debian2 products
- mosquitto< 1.4.15-1
- debian_linuxEOL7.0 | 8.0 | 9.0
Alpine1 product
- mosquitto< 1.4.15-r0
Eclipse1 product
- mosquitto≤ 1.4.14
The eclipse foundation1 product
- eclipse mosquitto1.4.14
Ubuntu1 product
- mosquitto< 0.15-2+deb7u3ubuntu0.1 | < 1.4.8-1ubuntu0.16.04.3
5 vendors · 6 products
References
10 links
lists.debian.org/debian-lts-announce/2018/03/msg00037.htmlMailing ListX Refsource MLISTThird Party Advisory- mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652/X Refsource CONFIRMPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2018/06/msg00016.htmlMailing ListX Refsource MLISTThird Party Advisory
- bugs.eclipse.org/bugs/show_bug.cgi?id=529754X Refsource CONFIRMExploitIssue TrackingThird Party Advisory