GHSA-63QC-P2X4-9FGF中危已审查

Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library

OSV 1.4.0 · github-reviewed · 修改于 2021-04-28 03:46

发布时间

2019-09-18 06:47

GitHub 审查时间

2019-09-14 05:47

NVD 发布时间

2019-09-12 02:15

源文件

advisories/github-reviewed/2019/09/GHSA-63qc-p2x4-9fgf/GHSA-63qc-p2x4-9fgf.json

公告说明

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

受影响的软件包

Maven

org.eclipse.paho:org.eclipse.paho.client.mqttv3

ECOSYSTEM

引入0修复1.2.1

标识信息

别名 / CVE

CVE-2019-11777

CWE

CWE-346CWE-755

软件生态

Maven

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

原始 OSV JSON

{
  "id": "GHSA-63qc-p2x4-9fgf",
  "aliases": [
    "CVE-2019-11777"
  ],
  "details": "In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.",
  "summary": "Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.1"
            }
          ]
        }
      ],
      "package": {
        "name": "org.eclipse.paho:org.eclipse.paho.client.mqttv3",
        "ecosystem": "Maven"
      }
    }
  ],
  "modified": "2021-04-27T19:46:40Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
    }
  ],
  "published": "2019-09-17T22:47:11Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11777",
      "type": "ADVISORY"
    },
    {
      "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=549934",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-346",
      "CWE-755"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": "2019-09-11T18:15:00Z",
    "github_reviewed_at": "2019-09-13T21:47:04Z"
  }
}