Lucene search

EclipseCVE-2019-11777

HistorySep 11, 2019 - 6:15 p.m.

CVE-2019-11777

2019-09-1118:15:10

CWE-755

CWE-346

eclipse

web.nvd.nist.gov

cve-2019-11777

eclipse paho

java client library

tls

mqtt server

hostname verifier

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.3

Confidence

High

EPSS

0.002

Percentile

52.9%

JSON

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

Affected configurations

Nvd

Node

eclipsepaho_java_clientMatch1.2.0

VendorProductVersionCPE
eclipsepaho_java_client1.2.0cpe:2.3:a:eclipse:paho_java_client:1.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eclipse	paho_java_client	1.2.0	cpe:2.3:a:eclipse:paho_java_client:1.2.0:::::::*

CNA Affected

[
  {
    "product": "Eclipse Paho",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.2.0"
      }
    ]
  }
]