What is GHSA-wv67-9jq7-8r69?

GHSA-wv67-9jq7-8r69 is a security advisory published by GitHub Security Advisories with High severity. Improper Input Validation and Buffer Over-read in mqtt-packet

Which CVE IDs does GHSA-wv67-9jq7-8r69 cover?

GHSA-wv67-9jq7-8r69 covers the following CVE IDs: CVE-2019-5432. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wv67-9jq7-8r69?

GHSA-wv67-9jq7-8r69 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-wv67-9jq7-8r69?

GHSA-wv67-9jq7-8r69 affects 4 products, including: npm/mqtt-packet:\u003c 3.5.1; npm/mqtt-packet:\u003e= 4.0.0, \u003c 4.1.3; npm/mqtt-packet:\u003e= 5.0.0, \u003c 5.6.1; npm/mqtt-packet:\u003e= 6.0.0, \u003c 6.1.2.

GHSA-wv67-9jq7-8r69HighCVSS 7.5

Improper Input Validation and Buffer Over-read in mqtt-packet

Vendor

GitHub Security Advisories

Published

May 14, 2019

Last Modified

February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-5432 →

📋 Description

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.

🎯 Affected products4

npm/mqtt-packet:< 3.5.1
npm/mqtt-packet:>= 4.0.0, < 4.1.3
npm/mqtt-packet:>= 5.0.0, < 5.6.1
npm/mqtt-packet:>= 6.0.0, < 6.1.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-5432
https://hackerone.com/reports/541354
https://github.com/advisories/GHSA-wv67-9jq7-8r69