Eclipse Mosquitto

Findings · 16

1. 1 Insucient default number of PBKDF2 iterations High
2. 2 Improper implementation of constant-time comparison Medium
3. 3 mosquitto_passwd creates world-readable password files High
4. 4 mosquitto_passwd trusts existing backup files High
5. 5 Heap buer overread issue in persist__chunk_client_write_v6 High
6. 6 mosquitto_ctrl dynsec init creates world-readable config High
7. 7 Race condition in file existence check by mosquitto_ctrl dynsec init High
8. 8 Use-after-free instances in dynsec_groups__find and dynsec_clients__find Undetermined
9. 9 NULL pointer dereference in dynsec_roles__config_load Low
10. 10 Broker creates world-readable TLS key log files High
11. 11 Broker trusts existing TLS key log files High
12. 12 libmosquitto accepts wildcard certificates for public suxes Medium
13. 13 Username characters not validated when taken from client certificate Medium
14. 14 Improper parsing of X-Forwarded-For header High
15. 15 Logger registers with DLT when DLT is not a log destination Informational
16. 16 Documentation recommends insecure encryption practices for TLS private key Informational

Findings extracted from the published report PDF. See the full report below for details and remediation.