CVE-2017-7652 — In Eclipse Mosquitto 1
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets availa
Published
2018-04-25T13:00:00.000Z
Last modified
2024-08-05T16:12:27.742Z
01What is this vulnerability?
In Eclipse Mosquitto 1.4.14, if a Mosquitto instance is set running with a configuration file, then sending a HUP signal to server triggers the configuration to be reloaded from disk. If there are lots of clients connected so that there are no more file descriptors/sockets available (default limit typically 1024 file descriptors on Linux), then opening the configuration file will fail.
02Affected products
| Vendor | Product | Versions |
|---|
| The Eclipse Foundation | Eclipse Mosquitto | 1.4.14 |
03Active exploitation status
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
04Recommended remediation
- Patch to a fixed version listed in the vendor advisory (see references below).
- Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
- Hunt historical logs for exploitation indicators — see Detection signatures below.
05Technical details
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
06Detection signatures
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
07Related CVEs
08Timeline
- Published: 2018-04-25T13:00:00.000Z
- Last modified: 2024-08-05T16:12:27.742Z
09References
- lists.debian.org — https://lists.debian.org/debian-lts-announce/2018/03/msg00037.html
- mosquitto.org — https://mosquitto.org/blog/2018/02/security-advisory-cve-2017-7651-cve-2017-7652…
- lists.debian.org — https://lists.debian.org/debian-lts-announce/2018/06/msg00016.html
- bugs.eclipse.org — https://bugs.eclipse.org/bugs/show_bug.cgi?id=530102
- www.debian.org — https://www.debian.org/security/2018/dsa-4325
Want this in your SOAR or SIEM?
SARA's API returns EPSS, CVSS, KEV, and an analyst-grade summary in one call.
Read the API reference →