USN-6492-1

    Dashboard / Vulnerabilities / USN-6492-1

    USN-6492-1

    Published: 21 Nov 2023Last Modified: 22 Apr 2026

    Summary: mosquitto vulnerabilities

    Details: Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431) Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause an authorisation bypass. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434) Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-41039) Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-0809) It was discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-3592) Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-28366)

    References: https://ubuntu.com/security/notices/USN-6492-1, https://ubuntu.com/security/CVE-2021-34431, https://ubuntu.com/security/CVE-2021-34434, https://ubuntu.com/security/CVE-2021-41039, https://ubuntu.com/security/CVE-2023-0809, https://ubuntu.com/security/CVE-2023-3592, https://ubuntu.com/security/CVE-2023-28366

    Affected packages

    Package

    Name: mosquitto

    Purl: pkg:deb/ubuntu/[email protected]~esm1?arch=source&distro=esm-apps/focal

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.6.9-1ubuntu0.1~esm1

    Affected versions

    1.6.6-1
    1.6.7-1
    1.6.8-1
    1.6.8-2
    1.6.9-1~build1
    1.6.9-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    USN-6492-1 | CVE-DB