https://bugzilla.redhat.com/show_bug.cgi?id=1879743
Bug ID: 1879743
Summary: CVE-2019-11777 org.eclipse.paho.client.mqttv3:
Improper hostname validation in the MQTT library
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: aileenc(a)redhat.com, chazlett(a)redhat.com,
drieden(a)redhat.com, extras-orphan(a)fedoraproject.org,
ggaughan(a)redhat.com, gmalinko(a)redhat.com,
janstey(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jochrist(a)redhat.com, jwon(a)redhat.com,
puntogil(a)libero.it
Target Milestone: ---
Classification: Other
In the Eclipse Paho Java client library version 1.2.0, when connecting to an
MQTT server using TLS and setting a host name verifier, the result of that
verification is not checked. This could allow one MQTT server to impersonate
another and provide the client library with incorrect information.
Upstream bug:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=549934
Upstream issue:
https://github.com/eclipse/paho.mqtt.java/issues/506
Upstream patch:
https://github.com/CVEProject/cvelist/pull/2537
--
You are receiving this mail because:
You are on the CC list for the bug.