CVE-2019-11779: canonical ubuntu_linux
CVSS: 6.5v3.1MediumModified
AliasesALPINE-CVE-2019-11779MGASA-2019-0345openSUSE-SU-2019:2247-1DEBIAN-CVE-2019-11779DSA-4570-1openSUSE-SU-2019:2206-1
Published 19-09-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-11779 is a medium (CVSS 6.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 2.74% chance of exploitation in the next 30 days, higher than 85.9% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
2.74%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-09-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
2.74%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.74% on 19-09-2026
19-09-202619-10-2026
EPSS score2.74%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected systems
Opensuse3 products
- backports_sle15.0:sp1
- leapEOL15.1
- mosquitto&distro=openSUSE Leap 15.1< 1.5.7-lp151.2.3.1
Debian2 products
- mosquitto< 1.6.6-1 | < 1.5.7-1+deb10u1
- debian_linuxEOL8.0 | 10.0
Alpine1 product
- mosquitto≥ 1.5, < 1.6.3-r1 | ≥ 1.5, < 1.6.7-r0 | ≥ 1.5, < 1.5.6-r1
Canonical1 product
- ubuntu_linuxEOL19.04
Eclipse1 product
- mosquitto≥ 1.5, < 1.5.9 | ≥ 1.6, < 1.6.6
Fedoraproject1 product
- fedoraEOL29 | 30 | 31
Mageia1 product
- mosquitto< 1.6.6-1.mga7
Suse1 product
- mosquitto&distro=SUSE Package Hub 15 SP1< 1.5.7-bp151.3.3.1
The eclipse foundation1 product
- eclipse mosquitto1.5.0 to 1.6.5 inclusive
9 vendors · 12 products
References
18 links- lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.debian.org/debian-lts-announce/2019/10/msg00035.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 18 references
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory