CVE-2019-5432: Improper Input Validation and Buffer Over-read in mqtt-packet
Summary
CVE-2019-5432: Improper Input Validation and Buffer Over-read in mqtt-packet. Affects mqtt-packet across 4 version ranges.
< 3.5.1
>= 4.0.0, < 4.1.3
>= 5.0.0, < 5.6.1
>= 6.0.0, < 6.1.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- node-mqtt-packet · Debian:11
The same CVE-2019-5432 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mqtt-packet is an npm package used for decoding MQTT (Message Queuing Telemetry Transport) packets. MQTT is a lightweight messaging protocol commonly used in IoT (Internet of Things) applications. The mqtt-packet module versions prior to 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, and 6.0.0 - 6.1.2 are vulnerable to an improper input validation and buffer over-read issue.
Vulnerability Detail
The vulnerability arises from a specifically malformed MQTT Subscribe packet that can crash MQTT Brokers when decoded using the affected versions of the mqtt-packet module. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition on MQTT Brokers. The issue is rated as HIGH severity with a CVSS score of 7.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.5.13.5.1npm install mqtt-packet@3.5.1 -
>= 4.0.0, < 4.1.34.1.3npm install mqtt-packet@4.1.3 -
>= 5.0.0, < 5.6.15.6.1npm install mqtt-packet@5.6.1 -
>= 6.0.0, < 6.1.26.1.2npm install mqtt-packet@6.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the mqtt-packet module to a non-vulnerable version.
Conclusion
The mqtt-packet module versions prior to 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, and 6.0.0 - 6.1.2 are vulnerable to an improper input validation and buffer over-read issue. This vulnerability can be exploited to cause a denial-of-service condition on MQTT Brokers. It is crucial to update the mqtt-packet module to a non-vulnerable version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mqtt-packet →
FAQ
mqtt-packet is an npm package used for decoding MQTT packets in IoT applications.
MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol commonly used in IoT applications.
The vulnerability can lead to a denial-of-service (DoS) condition on MQTT Brokers.
The vulnerability is rated as HIGH severity with a CVSS score of 7.5.
To fix the vulnerability, update the mqtt-packet module to the recommended non-vulnerable version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mqtt-packet.
