When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty, or contains only comments or blank lines, then Mosquitto will treat this as though no ACL file has been defined and use a default allow policy. The new behaviour is to have an empty ACL file mean that all access is denied, which is not a useful configuration but is not unexpected.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-mosquitto | Nov 8, 2019 | Mar 27, 2019 | |
| Debian | debian-upgrade-mosquitto | Feb 11, 2019 | Feb 10, 2019 | |
| Suse | — | suse-upgrade-libmosquitto1suse-upgrade-libmosquittopp1suse-upgrade-mosquittosuse-upgrade-mosquitto-clientssuse-upgrade-mosquitto-devel | Feb 23, 2019 | Feb 10, 2019 |
| Ubuntu | ubuntu-upgrade-mosquitto | Nov 19, 2024 | Mar 27, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub