Skip to content
Sign in
Not rated

CVE-2018-12546 In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has…

Description

In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a client publishes a retained message to a topic, then has its access to that topic revoked, the retained message will still be published to clients that subscribe to that topic in the future. In some applications this may result in clients being able cause effects that would otherwise not be allowed.

Affected products and versions

Product Affected versions Fixed in
Eclipse Mosquitto 1.5 earliest → 1.5.5 No fix stated
Eclipse Mosquitto 1.0 1.0 → latest No fix stated

Other CVEs of Eclipse Mosquitto

The 16 CVEs of Eclipse Mosquitto →
CVE-2021-41039 In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property… Not rated CVE-2021-34434 In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make… Not rated CVE-2021-34432 In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with… Not rated CVE-2021-34431 In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted… Not rated
Track this CVE