USN-6492-1 (UBUNTU-CVE-2021-34431)

Vulnerability from osv_ubuntu – Published: 2023-11-21 15:23 – Updated: 2026-04-22 07:37 – Source website
VLAI
Summary
mosquitto vulnerabilities
Details

Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)

Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause an authorisation bypass. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434)

Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-41039)

Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-0809)

It was discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-3592)

Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-28366)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-34431",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41039",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-0809",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-3592",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "libmosquitto1",
            "binary_version": "1.6.9-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "libmosquittopp1",
            "binary_version": "1.6.9-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "mosquitto",
            "binary_version": "1.6.9-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "mosquitto-clients",
            "binary_version": "1.6.9-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "mosquitto",
        "purl": "pkg:deb/ubuntu/mosquitto@1.6.9-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.9-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.6.6-1",
        "1.6.7-1",
        "1.6.8-1",
        "1.6.8-2",
        "1.6.9-1~build1",
        "1.6.9-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2021-34434",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2021-41039",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-0809",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-3592",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28366",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "libmosquitto1",
            "binary_version": "2.0.11-1ubuntu1.1"
          },
          {
            "binary_name": "libmosquittopp1",
            "binary_version": "2.0.11-1ubuntu1.1"
          },
          {
            "binary_name": "mosquitto",
            "binary_version": "2.0.11-1ubuntu1.1"
          },
          {
            "binary_name": "mosquitto-clients",
            "binary_version": "2.0.11-1ubuntu1.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "mosquitto",
        "purl": "pkg:deb/ubuntu/mosquitto@2.0.11-1ubuntu1.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.11-1ubuntu1.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.0.11-1",
        "2.0.11-1build1",
        "2.0.11-1ubuntu1"
      ]
    }
  ],
  "aliases": [],
  "details": "Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain\ninputs. If a user or an automated system were provided with a specially crafted\ninput, a remote attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431)\n\nZhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If\na user or an automated system were provided with a specially crafted input, a\nremote attacker could possibly use this issue to cause an authorisation bypass.\nThis issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434)\n\nZhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto\nincorrectly handled certain inputs. If a user or an automated system were\nprovided with a specially crafted input, a remote attacker could possibly use\nthis issue to cause a denial of service. This issue only affected Ubuntu 20.04\nLTS and Ubuntu 22.04 LTS. (CVE-2021-41039)\n\nZhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a\nuser or an automated system were provided with a specially crafted input file,\na remote attacker could possibly use this issue to cause a denial of service.\n(CVE-2023-0809)\n\nIt was discovered that Mosquitto incorrectly handled certain inputs. If a user\nor an automated system were provided with a specially crafted input, a remote\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2023-3592)\n\nMischa Bachmann discovered that Mosquitto incorrectly handled certain inputs.\nIf a user or an automated system were provided with a specially crafted input,\na remote attacker could possibly use this issue to cause a denial of service.\nThis issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04.\n(CVE-2023-28366)\n",
  "id": "USN-6492-1",
  "modified": "2026-04-22T07:37:06Z",
  "published": "2023-11-21T15:23:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6492-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-34431"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-34434"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2021-41039"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-0809"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-3592"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28366"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "mosquitto vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2021-34431",
    "UBUNTU-CVE-2021-34434",
    "UBUNTU-CVE-2021-41039",
    "UBUNTU-CVE-2023-0809",
    "UBUNTU-CVE-2023-3592",
    "UBUNTU-CVE-2023-28366"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.