GitHub Advisoryadvisory · Maven

GHSA-63qc-p2x4-9fgf Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library

MEDIUM Published 2019-09-17 Modified 2021-04-27 Official page ↗
Aliases
CVE-2019-11777
Ecosystem
Maven
Packages
org.eclipse.paho:org.eclipse.paho.client.mqttv3
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-346, CWE-755
Reviewed
2019-09-13

Affected packages

• Maven org.eclipse.paho:org.eclipse.paho.client.mqttv3: < 1.2.1 → fixed in 1.2.1

Description

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

Related

Alias · CVE (1)

  • CVE-2019-11777 In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the… vulnerability

Weakness · CWE (2)

  • CWE-346 Origin Validation Error weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References