CVE-2018-12543

描述

In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a message is published to Mosquitto that has a topic starting with $, but that is not $SYS, e.g. $test/test, then an assert is triggered that should otherwise not be reachable and Mosquitto will exit.

如何修補 CVE-2018-12543

要修補 CVE-2018-12543,請將受影響套件升級到下列已修補版本。

• Alpine/mosquitto—升級至 1.5.3-r0 或更新版本

CVE-2018-12543 正在被利用嗎?

中等 — EPSS 為 36.0%,可持續追蹤但非最高優先。

受影響套件(1)

• >= 1.5.0, < 1.5.3-r0

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-12543