libwebsockets MQTT PUBACK out-of-bounds write allows remote code execution
A program part used for web communication can be hacked.
Summary
An out-of-bounds write in how libwebsockets handles MQTT PUBACK packets lets an unauthenticated remote attacker execute arbitrary code. Programs that use this library are affected.
Affected when
- MQTT protocol handling in use
What to do
If a program uses libwebsockets, update it to a version that includes this fix (commit c9e8e18). No fixed version number is given in the sources, so check the vendor's notice.
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen