Vulnerability in wolfmqtt Package: UNKNOWN READ in MqttProps_Free
Summary
OSV-2023-1240: UNKNOWN READ in MqttProps_Free. Affects wolfmqtt versions >= bc7ae0af80ce2053e1e0992eb5e1f51bd3344896, < 96c69d875b91fba9ac501f1376144bf662644252. Fixed in 96c69d875b91fba9ac501f1376144bf662644252. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wolfmqtt package is an open-source MQTT (Message Queuing Telemetry Transport) client library developed by wolfSSL. It provides a lightweight and efficient implementation of the MQTT protocol for embedded systems and IoT devices. The package is widely used in various applications that require MQTT communication capabilities.
Vulnerability Detail
The vulnerability identified in the wolfmqtt package is an UNKNOWN READ issue in the MqttProps_Free function. This vulnerability was reported through the OSS-Fuzz project, and the specific crash state observed was MqttProps_Free, Handle_Props, MqttClient_DecodePacket. The exact cause and impact of this vulnerability are not disclosed in the provided information. However, it is categorized as having a MEDIUM severity level.
How To Fix
Minimum fixed version
96c69d875b91fba9ac501f1376144bf662644252
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround is mentioned for this vulnerability. It is advised to follow the recommended fix and update the package to the latest version.
Conclusion
In conclusion, the wolfmqtt package is affected by an UNKNOWN READ vulnerability in the MqttProps_Free function. To mitigate this vulnerability, it is recommended to update the package to the latest version that includes the fix. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for wolfmqtt →
FAQ
The wolfmqtt package is an open-source MQTT client library developed by wolfSSL. It provides MQTT communication capabilities for embedded systems and IoT devices.
The exact impact of this vulnerability is not disclosed in the provided information. However, it is categorized as having a MEDIUM severity level.
To fix this vulnerability, it is recommended to update the wolfmqtt package to the latest version that includes the fix.
No specific workaround is mentioned for this vulnerability. It is advised to follow the recommended fix and update the package to the latest version.
For more information about this vulnerability, you can refer to the provided OSS-Fuzz report and the source link in the database-specific section of the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for wolfmqtt.
